I asked one of the engineers about this, he said: When launching an AMI from the marketplace, the user will pick their own ssh keys for access to the instance, usually using the 'ubuntu' user. I doubt the 'splunk' user has any keys setup for SSH access, but a customer could set them up themselves. There is probably no password, it just uses SSH key for auth. ... View more

Also having same issue with the Forescout App - anyone ever get anywhere with this? ... View more

Great Advice! specifying the domain or using the UPN was able to successfully complete the install. ... View more