Hi @ronerf I've had the same issue as you when I changed the authentication from LDAP to SAML. My solution was to reassign the Knowledge Objects to the new naming schema because it was only for a couple of users. I don't know how Okta works but it's generally possible for IDPs to change the way, a username is send to Splunk. Maybe the Okta Support can help you changing the transfered username or you reassign the Knowledge Objects manually. Kind regards, Dennis ... View more

Hi @lycollicott, Thank you for your answer! That sounds like a good workaround. I didn't investigate this error any further, as it isn't really a 'problem'. Do you have already an update on this? ... View more

Hi @mawomommoh, First, please don't use the standard credentials as it's a big security problem. Deleting $SPLUNK_HOME/etc/passwd is a good way to restore the default admin credentials. After that, I would totally recommend to change the default password to anything else by typing this command on the CLI: splunk edit user <username> -auth admin:<admin_password> --newpassword <password> If you're using a 7.x Universal Forwarder, I guess you had to enter an admin password while/after the installation, so admin/changeme won't work. See also here: https://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Changeapassword#Change_a_user_password_in_the_command_line ... View more