Have you tried resetting the admin password? https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Secureyouradminaccount You must have the ability to write to the underlying password file ($SPLUNK_HOME/etc/passwd). splunk cmd splunkd rest --noauth POST /services/admin/users/admin "password=<your password>" You must restart Splunk Enterprise after making this change. ... View more