How can I change the password without knowing the default or entered password for the forwarder?

[shawno]

/opt/splunkforwarder/bin/splunk edit user admin -password $NEWPASSWORD

This doesn't work - how can I change the password without knowing the default or entered password for the forwarder?

[cmoyanof]

Hello,

May be will be useful for you to copy the bold text below into another admin user with a known password /opt/splunkforwarder/etc/passwd

:admin:$6$zGmwWFy17AEdVhjN$9YkUUBa4LM.Eds96Qs.DtjPOjorXVT57dasdasdasdaca.hxJ75.mmsrYNLmSXcVqu3gHbdBRJXtXv/ceBm1::Administrator:admin:changeme@example.com:::32533

Restart Splunk. After the restart you should be able to login using the previous splunkforwarder

[ansif]

Try below steps:

• Move the $SPLUNK_HOME/etc/passwd file
  to $SPLUNK_HOME/etc/passwd.bak

• Restart Splunk. After the restart you
  should be able to login using the
  default login (admin/changeme).