How do I reset only admin password?

[spl109]

The splunk version is 6.6.3.

I have two user accounts. admin and test_admin.

When the admin password is reset, the test_admin account is deleted.

Question) Can I reset only the admin password?

[iamarkaprabha]

Hi ,

You can try resetting the admin password as per the guideline of below post
https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html

How to do this in 7.1 + :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk
Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory.
In the file add the following text:

[user_info]
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.
Start Splunk Enterprise and use the new password to log into your instance from Splunk Web.
If you previously created other users and know their login details, copy and paste their credentials from the passwbk file into the passwd file and restart Splunk.

Versions prior to 7.1 :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passw) and rename it to passw.bk
Start Splunk Enterprise and login to your instance from Splunk Web using the default credentials of admin/changeme.
You will be asked to enter a new password for your admin account.
If you previously created other users and know their login details, copy and paste their credentials from the passw.bk file into the passwd file and restart Splunk.

[spl109]

Thank you for answer.

But
If you do this the test_admin account will be deleted.

I want to delete only the password for the admin account.

[iamarkaprabha]

splunk edit user admin -password newPassowrd  -auth admin:changeme 

[iamarkaprabha]

i believe you can edit for admin also , didn't try for test_admin , i have to check