Splunk Enterprise

Splunk password issue

uagraw01
Motivator

I am getting below error. Although I have changed my password & user name from user-seed.conf. But still it is showing below error.

uagraw01_0-1681743763165.png

But when I am login to UI, below are the error I am getting. Please help me how to fix this error.

uagraw01_0-1681743624386.png

 

 

0 Karma

woodcock
Esteemed Legend

If no users exist that means that the $SPLUNK_HOME/etc/passwd file is missing.  To create a new admin user, you can use user-seed.conf and it is very easy.   Just double check your steps here:
https://docs.splunk.com/Documentation/Splunk/latest/Security/Secureyouradminaccount

0 Karma

PickleRick
SplunkTrust
SplunkTrust
# If the $SPLUNK_HOME/etc/passwd file is present,
the settings in this file (user-seed.conf) are not used
0 Karma

uagraw01
Motivator

@PickleRick 
No passwd file is generating after restarting of the Splunk.

uagraw01_0-1681745004108.png

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As @PickleRick said you cannot have .../<SPLUNK_HOME>/etc/passwd file. If you have then you could use e.g.

Create admin credentials for automated installations with the 'hash-passwd' CLI command

to generate hashed password and add/change it into passwd file as already proposed.

r. Ismo

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Did you restart your splunk instance?

0 Karma

uagraw01
Motivator

@PickleRick Yes I have restarted

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

To be fully honest, if you already have a working installation, I would just edit etc/passwd manually and insert a hashed password there.

But if you don't have etc/passwd and it's not getting created from user-seed.conf - there must be something wrong. Check the splunkd.log for errors. Permission issues?

0 Karma

uagraw01
Motivator

@PickleRick & @isoutamo  It has been fixed. I was used to save the seed file as user-seed.conf. So when I restarted the Splunk it saved as user-seed.conf.conf. So I corrected and saved the file only as user-seed and gives the results as user-seed.conf and generated the passwd  file also.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...