I installed splunk on Centos 7 and have it running with the systemctl commands.
On my first login I got an error when I tried to change the password.
So now it gets back to the login page if I use the changeme password. Any other password gives me a password error.
I tried the suggested removal of the splunk password file to see if I could get back to the changeme procedure but it did not resolve the issue.
What information can I look into to resolve the issue?
Do this:
splunk stop # does not require password
mv /opt/splunk*/etc/passwd /opt/splunk*/etc/passwd.bak # NOTE: also removes all other splunk users
splunk start # does not require password; the admin user is recreated and the password will be `changeme`
Try this from command line:
$SPLUNK_HOME/bin/splunk edit user admin -password "apassword"
Replace $SPLUNK_HOME with the path to splunk if $SPLUNK_HOME is not defined in your environment.
Then you should be able to log as admin and the password you gave in the command.
See this for other examples:
https://docs.splunk.com/Documentation/Splunk/6.6.0/Security/ConfigureuserswiththeCLI
Maybe you can add a new admin user and then edit the old via GUI if you want...