Splunk Enterprise

Enterprise Login Help

DaltonCarmon
Engager

I am trying to learn Splunk Enterprise. I created the account, logged in, no problem. I downloaded the demo data and did some stuff with that. This is over a few days. Finally today, I was not able to login. It said my login info was incorrect. 
I figured I had messed the password somehow, and reset it by going to Command Line and using command "del /f /q "C:\Program Files\Splunk\etc\passwd"

Now on the Splunk Enterprise Page there is a note saying 'No users exist. Please set up a user'. 

How?

And have I lost the demo date?

Labels (1)
0 Karma
1 Solution

kiran_panchavat
Champion

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

View solution in original post

kiran_panchavat
Champion

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

PickleRick
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...