I forgot my login details

[Bet1]

Pls I need help I forgot my splunk login details .how to I go about it ?

[PrewinThomas]

@Bet1 

-Stop Splunk Enterprise.
-Find the passwd file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk
-Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory.

In the file add the following text:

[user_info]
USERNAME = admin
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.
Start Splunk Enterprise and use the new password to log into your instance from Splunk Web.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[thahir]

@Bet1  Please follow the below steps to reset the Splunk login

1. Navigate to the Splunk configuration directory

<Splunk installation directory>/splunk/etc/

2. Back up the existing password file

mv passwd passwd.backup

3. Go to the local system configuration folder

<Splunk installation directory>/splunk/etc/system/local/

4. Create a new file named user-seed.conf

Add the following contents inside the file (replace <newpassword> with your desired password):

[user_info]
USERNAME = admin
PASSWORD = <newpassword>

5. Restart Splunk from the command line

<Splunk installation directory>/splunk/bin/splunk restart