Security

Some splunk command lines ask for username; forwarders don't have user?

Path Finder

I'm trying to debug some issues with the deployment server. This causes me to want to run things like 'splunk display deploy-client' on the forwarder, but when I do so it asks for credentials:

[root@frwrdr ~]# splunk display deploy-client
Splunk username:

I do not know what credentials it will accept. If I do this on the indexer/search head, then my normal Splunk credentials (which are backed by LDAP authentication) work. However, that is not the case on the forwarder host. Nor do my local credentials on the forwarder host work.

What should I be doing here? Setting a password for the local 'splunk' user and using that?

1 Solution

Splunk Employee
Splunk Employee

The forwarder has the same credentials by default as the indexer does. The default l/p is admin/changeme. You should use that account, but change the password from the default.

View solution in original post

New Member

$SPLUNK_HOME/bin/splunk set deploy-poll :8089 -auth admin:changeme
No users exist. Please set up a user.,

0 Karma

Splunk Employee
Splunk Employee

So what you need to do is specify the password, but not the user. Simply do:

/opt/splunkforwarder/bin/splunk set deployment-poll HOSTNAME:8089 -auth :changeme

/opt/splunkforwarder/bin/splunk display deploy-client -auth :changeme
0 Karma

Explorer

The default credentials are admin:changeme, so use those until you set it, which you can do with

/opt/splunkforwarder/bin/splunk edit user admin -password YOUR_NEW_PASSWORD -auth admin:changeme

Splunk Employee
Splunk Employee

The forwarder has the same credentials by default as the indexer does. The default l/p is admin/changeme. You should use that account, but change the password from the default.

View solution in original post

Splunk Employee
Splunk Employee

Glad I could help out. Please feel free to upvote if you found this useful.

0 Karma

New Member

I'm getting error while using admin/changeme combination as well. Any guesses?

0 Karma

Path Finder

Excellent, the admin user works. I suppose it shouldn't be surprising that LDAP users won't chain out to forwarders. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!