LOgin problem on new installation

[hvdk]

I installed splunk on Centos 7 and have it running with the systemctl commands.
On my first login I got an error when I tried to change the password.
So now it gets back to the login page if I use the changeme password. Any other password gives me a password error.
I tried the suggested removal of the splunk password file to see if I could get back to the changeme procedure but it did not resolve the issue.

What information can I look into to resolve the issue?

[woodcock]

Do this:

splunk stop # does not require password
mv /opt/splunk*/etc/passwd /opt/splunk*/etc/passwd.bak # NOTE: also removes all other splunk users
splunk start # does not require password; the admin user is recreated and the password will be `changeme`

[jkat54]

Try this from command line:

$SPLUNK_HOME/bin/splunk edit user admin -password "apassword"

Replace $SPLUNK_HOME with the path to splunk if $SPLUNK_HOME is not defined in your environment.

Then you should be able to log as admin and the password you gave in the command.

See this for other examples:
https://docs.splunk.com/Documentation/Splunk/6.6.0/Security/ConfigureuserswiththeCLI

Maybe you can add a new admin user and then edit the old via GUI if you want...