First I installed using the .deb package. After install I went to the default GUI page and put in the initial password of "changeme". After typing in the change password fields I get "Server error". I reload the page and put in my new password and get invalid password. I put in "changeme" and get "Your session has expired. Log in to return to the system."
I searched through answers to other questions and tried these:
Clearing cache and restarting the client machine
Tried running this command both before and after trying to change the password in the GUI (./splunk edit user admin -password newpassword -auth admin:changeme)
Some noted issues with the .deb package and recommended using the .tar to install. I've tried this also, I'm currently installed using this.
I didn't have this problem when I installed it on Red Hat, only Ubuntu.
hard to understand what you mean, but if you need to reset the amdin password go to
SPLUNK_HOME/splunk/etc/ and delete the file
passwd .Restart splunk and your web admin password should be "changeme" again.
I've tried this previously also and I still receive the same error. It happens every time I change the password from the initial "changeme" password. Red text will display under the change password prompt that says "Server Error". I am then redirected to log in. If I use the new credentials I just made I get invalid password returned, if I use the "changeme" password again I get the Session has expired. No matter how many times I try to log in with either. I've uninstalled/reinstalled. I've used that CLI command in my post and I've deleted the .passwd file.
Have you checked the file permissions and ownership to make sure that when Splunk tries to write the password it has permissions to do so?