splunk forwarder : Remote login has been disabled for 'admin' with the default password. How to login or reset password?

[mikki]

Upgraded universal splunk universal forwarder from 9.0.2 to 9.1.0. 

./splunk list monitor gives me the following error with default password : "Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file." for the first time.

./splunk edit user admin -password <newpassword> -auth admin:changeme

tried above command to reset default password: still gives me : "Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file."

Looking for any answers.

[mikki]

setting "allowRemoteLogin" in server.conf did allow default password and then I changed the password using above ./splunk edit user ...

Thanks.

[P_vandereerden · Accepted solution]

Have you tried the second option (allowRemoteLogin)? I can't say I've seen this myself, but it could be that you need to temporarily change that setting to get around the default password problem. If that works, then once you've changed your password, you should be able to revert the allowRemoteLogin setting.

The following should help for values:

# The following 'allowRemoteLogin' setting controls remote management of your splunk instance.
#  - If set to 'always', all remote logins are allowed.
#  - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow
#    remote management through splunkweb if splunkweb is on the same server.
#  - If set to 'requireSetPassword' (default behavior):
#     1. In the free license, remote login is disabled.
#     2. In the pro license, remote login is only disabled for the admin user that has not changed their default password