Unable to login splunk enterprise!

New Member

Hi Team,

i have restarted the Splunk server and i tried to login again with same user name and password. could not able to login ..even i have tried with new user name and password with same result.

i have un installed the splunk enterprise and given user password but i am getting error message saying like "Login failed"

can somebody help me on this.


Tags (1)
0 Karma

Ultra Champion

If you restore config files from $SPLUNK_HOME/etc over the top of a fresh installation you need to be mindful of a few things.

$SPLUNK_HOME/etc/auth/splunk.secret needs to be restored to the correct location before you start Splunk for the first time.
$SPLUNK_HOME/etc/passwd needs to be restored to enable any local users (admin)

If you didn't replace both of these files with the original version before you started Splunk you are in a pickle.
The issue you now have is that all of the encrypted passwords in all the config files will be unreadable.

Best approach (assuming you have backups of the two files above) is to wipe/reinstall making sure those files are there first.

If you do not have those files (or otherwise cant take this approach).
Stop Splunk
Delete $SPLUNK_HOME/etc/passwd (any local splunk users on that box will loose their passwords)
Start Splunk - this should prompt you to set a password for admin (or use the user-seed.conf approach

Confirm you can login as admin.
Have any local users reset their passwords - admin will have to supervise.
Replace any encrypted passwords in .conf files with Plaintext passwords and restart Splunk to have it re-encrypt them with the new secret.
Confirm any passwords or keys for external auth (SAML/LDAP/MFA) are replaced.

If my comment helps, please give it a thumbs up!

Ultra Champion

how did you perform the restore?
did you install splunk, and then copy configs back in?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...