I know this thread is old but it is the first to pop up on Google.
In my case I had performed the following steps on my AWS Splunk Enterprise instance:
Cloned admin account
On the cloned admin account setup a named user.
Stored credentials in a password manager.
Logged out of the admin account and logged in with new admin account.
Deleted the default admin account.
I didn't have any issues but after updating the instance and rebooting I could not login - "Invalid Username or Password"
I was about to perform the steps provided by @piebob but did the following instead. Also, I notice $SPLUNK_HOME is referenced a lot on these boards but I think there are people who aren't sure where the home path hence the reason for my find command - I might be easy to mix up the OS /etc/passwd file.
sudo find / -name passwd
sudo cat /opt/splunk/etc/passwd
sudo cp /opt/splunk/etc/passwd /opt/splunk/etc/passwd.BACKUP
sudo /opt/splunk/bin/splunk stop
sudo /opt/splunk/bin/splunk start
After stopping and starting again I could login normally. If I didn't have a million other things to do I would troubleshoot but for now, I can login.
... View more