Getting Data In
Highlighted

How can I change the password without knowing the default or entered password for the forwarder?

New Member

/opt/splunkforwarder/bin/splunk edit user admin -password $NEWPASSWORD

This doesn't work - how can I change the password without knowing the default or entered password for the forwarder?

0 Karma
Highlighted

Re: How can I change the password without knowing the default or entered password for the forwarder?

Motivator

Try below steps:

  • Move the $SPLUNKHOME/etc/passwd file
    to $SPLUNK
    HOME/etc/passwd.bak

  • Restart Splunk. After the restart you
    should be able to login using the
    default login (admin/changeme).

0 Karma
Highlighted

Re: How can I change the password without knowing the default or entered password for the forwarder?

New Member

Hello,

May be will be useful for you to copy the bold text below into another admin user with a known password /opt/splunkforwarder/etc/passwd

:admin:$6$zGmwWFy17AEdVhjN$9YkUUBa4LM.Eds96Qs.DtjPOjorXVT57dasdasdasdaca.hxJ75.mmsrYNLmSXcVqu3gHbdBRJXtXv/ceBm1::Administrator:admin:changeme@example.com:::32533

Restart Splunk. After the restart you should be able to login using the previous splunkforwarder

0 Karma