Splunk Enterprise

Enterprise Login Help

DaltonCarmon
Engager

I am trying to learn Splunk Enterprise. I created the account, logged in, no problem. I downloaded the demo data and did some stuff with that. This is over a few days. Finally today, I was not able to login. It said my login info was incorrect. 
I figured I had messed the password somehow, and reset it by going to Command Line and using command "del /f /q "C:\Program Files\Splunk\etc\passwd"

Now on the Splunk Enterprise Page there is a note saying 'No users exist. Please set up a user'. 

How?

And have I lost the demo date?

Labels (1)
0 Karma
1 Solution

kiran_panchavat
SplunkTrust
SplunkTrust

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

View solution in original post

kiran_panchavat
SplunkTrust
SplunkTrust

@DaltonCarmon 

  • When you change the Splunk password, either via the GUI or via the CLI, the $SPLUNK_HOME\etc\passwd file is updated and thereafter user-seed.conf is ignored.
  • However, if $SPLUNK_HOME\etc\passwd is ever deleted, user-seed.conf will again specify the default admin login password.
Place user-seed.conf in C:\Program Files\Splunk\etc\system\local (not default). Files in local override default and are meant for custom configurations.
 
 
To configure the default username and password, place the user-seed.conf file in
$SPLUNK_HOME\etc\system\local. You must restart Splunk for these settings to take effect.
 
Note: If the $SPLUNK_HOME\etc\passwd file exists, the configurations in user-seed.conf will be ignored.
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

PickleRick
SplunkTrust
SplunkTrust
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Developer Spotlight with Denis Gladkikh

From Splunk Engineer to Kubernetes App Builder Denis GladkikhWhat happens when a lifelong developer turns a ...

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...