Splunk Enterprise

Enterprise Login Help

DaltonCarmon
Engager

I am trying to learn Splunk Enterprise. I created the account, logged in, no problem. I downloaded the demo data and did some stuff with that. This is over a few days. Finally today, I was not able to login. It said my login info was incorrect. 
I figured I had messed the password somehow, and reset it by going to Command Line and using command "del /f /q "C:\Program Files\Splunk\etc\passwd"

Now on the Splunk Enterprise Page there is a note saying 'No users exist. Please set up a user'. 

How?

And have I lost the demo date?

Labels (1)
0 Karma
1 Solution

kiran_panchavat
Champion

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

View solution in original post

kiran_panchavat
Champion

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

PickleRick
SplunkTrust
SplunkTrust
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...