admin password reset back to default? bug?

[Michael]

I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.

So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?

I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...

Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉

Michael

[mattymo]

How did you do the upgrade? tar? rpm?

Like Muebel said, my guess is etc/passwd got moved or overwritten

[Michael]

Ah, that may be it, the sys-admin for the box is using Salt... when check and get back...

[muebel]

Hi Michael,

The admin passwd can get set to default if the etc/passwd file in splunk's installation directory is cleared. Perhaps this is what happened?

Past that, my only readily available explanation is that it was never set to begin with.

If neither of these fit, yeah, file a P4 with support and see if they have any advice.

Please let me know if this answers your question! 😄