Splunk admin user changes from version 7->8

[gauravmsharma]

Will upgarding my splunk installation from version 7 to 8 it seems like the default admin user name and default password does not exsist anymore. Below is the code which i use:

- name: check if password change is required

    command: /opt/splunk/bin/splunk login -auth admin:changeme

    register: login_result

    ignore_errors: true

  - name: change instance password

    command: /opt/splunk/bin/splunk edit user admin -role admin -auth admin:changeme -password {{ admin_password }}

    when: login_result is succeeded

The code above while running gives an error 

"msg": "non-zero return code", "rc": 24, "start": "2020-09-03 13:06:30.914377", "stderr": "No users exist. Please set up a user.", "stderr_lines": ["No users exist. Please set up a user."]

Does anyone have faced the same issue?

[isoutamo · Accepted solution]

That is documented change. You must add user and password before you start splunk or generate it when it starts first time.

• https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Secureyouradminaccount
• https://docs.splunk.com/Documentation/Splunk/8.0.5/Installation/StartSplunkforthefirsttime

In ansible it’s easy to create this user-seed.conf with ini_file module before you start splunk first time.

r. Ismo