How to reset admin password of Splunk UBA's webui

[archip]

Hello,

I unfortunately lost my webui password for admin account. What is the way to reset it ? I mean I know that on Splunk enterprise, there is used-seed, rest-api and even cli command but I can't find any clue about Splunk UBA.

Thanks for the help

[archip]

Hello,

Splunk support helped me and gave me the solution.

there is no feature to easily reset the password for a user. The admin needs to update it directly in de database :

su caspida

psql -d caspidadb

update accounts set password=md5('changeme') where email='admin';

Replace "admin" with your username and "changeme" with chosen password.