ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin

[sbhat13]

Hi,
We noticed the disk space is crossing the threshold >85% for the /opt/splunk mount point in one of our Dev Splunk AWS instance.On checking we are getting multiple error entries in splunkd.log for authentication failure as below.
We did try to reset the admin password to check if it resolves as per https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html but it did not help.

Please let us know what is the reason for the issue.
08-22-2016 09:37:21.345 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin
08-22-2016 09:37:21.397 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin

Error entries in audit log
08-22-2016 09:52:33.442 -0400 INFO AuditLogger - Audit:[timestamp=08-22-2016 09:52:33.442, id=22436721, user=admin, action=login attempt, info=failed][CVflHg3ekijQ+pPJxiiEPzHYxYkf6URGn8U7moMrgcezqbmJYnZjkFtn/KS4sIfb5Di91lblaZlmTaymQj4ey21AhyUUOR5t7Vyr81wcovG1vLSUN0OWLu3uuHn1oUFNysW9u29gMa0dMIzQ7Apv+gjL00GtMWX6Rr9WW46lhDc

Please let me know if there is anyway to resolve this.

Thanks,
Soumya

[adilsonbna]

I've got the same issue. It not admin password from Splunk server. Login admin and password is default by client one.

I just used command
./splunk add forward-server :9997

Splunk username: admin
Password: changeme
Added forwarding to: xx.xx.xx.xxx:9997.

It works!