Installing Splunk with existing splunk.secret

[matthewssa]

Hello!

My situation is I'm doing a new installation of Splunk on a windows instance with an existing splunk.secret.

Question: Is there a command line flag to pass the splunk.secret during the initial installation?

My process in the past was to install Splunk without launching in order to prevent passwords from being generated. Then copy the splunk.secret over and start Splunk. It has been a while though and I think something changed, because Splunk writes a password to server.conf even if it isn't started for the first time. Now I have to remove the password with another command before starting it. 

[matthewssa]

This was a writeup that I did for this

Backup Splunk

1. Stop and Backup the entire Splunk folder if able.

/opt/splunk/bin/splunk stop

tar -zcvf splunk_pre_secret.tar.gz /opt/splunk/etc

Find encrypted passwords

find /opt/splunk/etc -name '*.conf' -exec grep -inH '\$[0-9]\$' {} \;

1. Record the context (file location, stanza, parameter)
2. Can decrypt the hashed passwords with the following

/opt/splunk/bin/splunk show-decrypted --value 'PASSWORDHASH'

Updating the splunk.secret

1. Copy the splunk.secret file from 192.168.70.2 to /opt/splunk/etc/auth/splunk.secret on the target system.

cp /home/dapslunk/splunk.secret /opt/splunk/etc/auth/splunk.secret

1. Ensure the permissions are correct 400

ll /opt/splunk/etc/auth/splunk.secret

Update all of the password sections

1. Use the following to find any missed passwords that have not been corrected.

find /opt/splunk/etc -name '*.conf' -exec grep -inH '\$[0-9]\$' {} \;

Restart Splunk

/opt/splunk/bin/splunk restart

Verify

1. Access to Splunk GUI
2. If any splunk commands that require authentication work
3. Connection to license master /cluster/ deployment server
4. If any inputs have data coming in
5. If LDAP authentication works
6. If all passwords are encrypted. Use the command from before.

[woodcock]

Install Splunk the way that you plan to.  Start Splunk. See what the pat is where it creates the splunk.secret file.  Stop Splunk.  Remove EVERYTHING.  Reinstall Splunk. BEFORE YOU START SPLUNK, drop the splunk.secret file.  Start Splunk.