Security

unable to login to splunk enterprise on my local machine i get invalid username or password

khonzoh
Engager

I downloaded and configured splunk enterprise and mhn app, and I was able to view my data. But I can not login now. I have tried the same username and password, still could not login. Please help

Tags (2)
1 Solution

Richfez
SplunkTrust
SplunkTrust

If you didn't change the default username/password, it's admin, changeme. Also check your caps lock key. 🙂

If those don't resolve it, which I expect it won't, then you can reset the passwords of the system if you have local access to it.

NOTE this will do two things - remove ALL usernames and passwords from the system except admin, and will reset the admin password to "changeme".

Linux:
Open a terminal session. Into there type:

cd /opt/splunk/etc/
sudo mv passwd passwd.bak

Then restart your Splunk.

Windows:
Open an elevated command prompt. (Click start, type "command" and when you see "Command Prompt" show up right-click on it and select "Run as administrator). Into there type:

cd \program files\splunk\etc
ren passwd passwd.bak

Then restart your Splunk.

Let us know if you have any difficulties!

Happy Splunking,
Rich

View solution in original post

somebloke
Engager

I have followed the admin steps multiple times, I can log into my splunk account, yet simply cannot log into splunk enterprises. Not very helpful in the slightest.

somebloke
Engager

This is a frustrating set of affairs, this program seems to not be intuitive and or/sensible. I can log into my splunk account, I have changed my passwords, I have followed these steps numerous times yet splunk enterprise will not let me log in. Bodes well for an assignment due this week does it not?

0 Karma

akhilasivasanka
Engager

For Splunk 7.x.x version and later, try the below.

username = admin
password = The password specified while installation

If you are still unable to login, remove the password file from ****/etc/passwd and reload the enterprise login page and try logging in.

Thanks,

MuS
Legend

Well, this way you would have successfully killed all OS users but not the Splunk users 😉
Next time try $SPLUNK_HOME/etc/passwd instead ...

cheers, MuS

0 Karma

Reshma_Vidhate
New Member

I have followed above mention steps for windows machine. But I am still not able to login for SPlunk Enterprise

0 Karma

niketn
Legend

@Reshma_Vidhate if you are trying to install Splunk Enterpris 7.1 it would ask your to reset your password during the installation. So uninstall and reinstall and make a note of updated admin password during installation.

If you want to reset existing password in 7.1, you should refer to following answer by @cbreshears: https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Richfez
SplunkTrust
SplunkTrust

Hi, @Reshma_Vidhate,

You would be better served to ask your own Question - a new thread will let everyone work through your problem specifically and is much more likely to get you a good answer.

And it's easy! For the fastest, best answer, include specifics: Splunk version, if there was anything "password related" you did when you installed it (like did you see a prompt for a password? Or did you not?), which platform you are on - Windows or Linux, how exactly are you trying to log in (url involved?) and finally what exactly does it do when you try.

Many thanks,
Rich

0 Karma

Shitiz
Explorer

I am also facing this issue..I followed the above mentioned steps but still getting the error...

xpac
SplunkTrust
SplunkTrust

Could you give some details on Splunk version, Windows or Linux, etc?

0 Karma

DonSmith
New Member

I too am unable to login on the free enterprise version, even after stopping splunk, renaming passwd, and restarting. I get "No users exist. Please set up a user."

0 Karma

Richfez
SplunkTrust
SplunkTrust

If you didn't change the default username/password, it's admin, changeme. Also check your caps lock key. 🙂

If those don't resolve it, which I expect it won't, then you can reset the passwords of the system if you have local access to it.

NOTE this will do two things - remove ALL usernames and passwords from the system except admin, and will reset the admin password to "changeme".

Linux:
Open a terminal session. Into there type:

cd /opt/splunk/etc/
sudo mv passwd passwd.bak

Then restart your Splunk.

Windows:
Open an elevated command prompt. (Click start, type "command" and when you see "Command Prompt" show up right-click on it and select "Run as administrator). Into there type:

cd \program files\splunk\etc
ren passwd passwd.bak

Then restart your Splunk.

Let us know if you have any difficulties!

Happy Splunking,
Rich

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...