How to Remove 'First time signing in?' message?

[evelenke]

Hi Splunkers,

after an upgrade to the latest version we keep receiving the following standard request on authentication page at every logon (the password for admin was changed long ago):

'First time signing in?
If you've forgotten your username or password, please contact your Splunk administrator.
username admin
password changeme'

How can we fix it?

[gurlest]

Having the SPLUNK_HOME/etc/.ui_login file on the host DOES make the banner go away (as noted in the linked articles above).

We did a bit of testing (since some of our servers had the file and others did not)...

Logging in with a LOCAL account (non-LDAP/SAML/etc) automatically generates the .ui_login file. 

Once we logged in with the LOCAL account, the .ui_login file existed and the "First time signing in?..." banner was gone.

[somesoni2 · Accepted solution]

Here you go.

https://answers.splunk.com/answers/115455/remove-first-time-logging-in-splunks-default-credentials-a...

[evelenke]

Great, thanks!