I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.
So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?
I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...
Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉
The admin passwd can get set to default if the etc/passwd file in splunk's installation directory is cleared. Perhaps this is what happened?
Past that, my only readily available explanation is that it was never set to begin with.
If neither of these fit, yeah, file a P4 with support and see if they have any advice.
Please let me know if this answers your question! 😄