splunk admin password not resetting

[tbarn005]

Hello, all i am fairly new to the Splunk community and I'm attempting to reset my Splunk admin password and for whatever reason it does not work i go and delete the "etc/passwd" and restart my Splunk instance and attempt to login to the web interface, but it never prompts me for a reset. I have even tried commands to do it manually, but nothing works. Has anyone else had a problem like this? 

[livehybrid]

Hi

To reset the admin password ensure you are stopping Splunk completely before deleting the passwd file.

# Stop Splunk Enterprise
cd $SPLUNK_HOME/bin
./splunk stop

# Remove the password file
rm $SPLUNK_HOME/etc/passwd

Now create a user-seed file ($SPLUNK_HOME/etc/user-seed.conf

[user_info]
USERNAME = admin
PASSWORD = YourPassword

Once done, start Splunk

$SPLUNK_HOME/bin/splunk start

You should now be able to login with the user/password set in the user-seed.conf file 

For more info check the following docs page:

https://docs.splunk.com/Documentation/Splunk/latest/Security/Secureyouradminaccount#Reset_the_admini...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing