Is there a way to change the splunk admin password from the command line when splunk isn't running?
Anytime I do a splunk install on our servers where splunk is on the net, I have to go manipulate firewall rules twice because splunk comes up with a default password. I'd really love to set that password to a specific one before I start splunk the first time.
To get rid of the "first time logging in?" messsage on the web app just touch $SPLUNK_HOME/etc/.ui_login
source: https://answers.splunk.com/answers/5543/how-can-i-remove-the-first-time-logging-in-hint-in-the-login... used "splunk edit user admin" but when the web app next comes up it does the whole "first time signing in" and change password which is annoying.
You can also start the splunk instance and then run the command
splunk edit user admin -password YOURNEWPASSWORD -auth admin:changeme
then restart the splunk instance: splunk restart
I have this on a batch file for deployment.