Solved: how to reset admin password in splunk 8? - Splunk Community

#Random

This is a place to discuss all things outside of Splunk, its products, and its use cases.

Hello, i'm trying to retrieve my lab's admin account but no success.

I tried the method of deleting the passwd file plus create user-seed.conf in system/local but didn't worked.

any ideas? Thanks!

1 Solution

Solution

The easiest way is to just to reset it by adding a user-seed.conf, deleting the existing entry in $SPLUNK_HOME/etc/passwd, then restarting splunk:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/User-seedconf

View solution in original post

Solution

The easiest way is to just to reset it by adding a user-seed.conf, deleting the existing entry in $SPLUNK_HOME/etc/passwd, then restarting splunk:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/User-seedconf

Have you tried resetting the password hash? i haven't tested it in 8 but a good write-up on it is available here: https://www.hurricanelabs.com/splunk-tutorials/splunk-7-1-performing-a-splunk-password-reset

Sorry for the delay in my answer, the link goes 404 😞

Looks like the hyperlink added the period onto it and broke the link. I just removed the period from the link and it should work now.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...