Restore Admin Roles in Splunk After Accidental Deletion

[sanjai]

Hi Splunker,

I am currently working with REST API calls for user management in Splunk. While attempting to add additional roles to the default admin account, I accidentally removed the admin role from this account. Unfortunately, I do not have any other user accounts with admin privileges.

At present, I only have a single user account with the "User" role and cannot create a new user with "Admin" privileges.

Could you please advise on how to restore the deleted roles to the existing user account or suggest any alternative solutions?

[sanjai]

Thanks @richgalloway  and @isoutamo  for your time , it worked 🙂🙌

[richgalloway]

Restore the $SPLUNK_HOME/etc/system/local/authorize.conf file from your most recent backup and restart Splunk.

[isoutamo · Accepted solution]

And if you haven’t backups (you really should), just add role admin to your admin user into authorize.conf file with any text editor. See authorize.conf specs how it should do.