How to Reset the Admin password?

[Lionel]

I just realized that I lost the Admin password and I need a way to access the system, with my Admin credentials.

[rgodishela]

Thank you. This worked.

[hythyt]

thanks this worked !....

[Swatikeshari]

mv /opt/splunk/etc/passwd /opt/splunk/etc/passwd.bak
mv: cannot move '/opt/splunk/etc/passwd' to '/opt/splunk/etc/passwd.bak': Permission denied

Why I am getting this error?

[reddyo]

Swati, You should try with root, splunk user doesn't have root permissions else add splunk user as NOPASSWD in sudoers file with root user as below and try again

vi /etc/sudoers ( with root user)

XXX ALL=(ALL) NOPASSWD:ALL here XXX is user name.

hope it should work 🙂

-Om

[Swatikeshari]

I have installed splunk in my Linux Ubuntu system. I have forgot the admin password and now I am trying to retrieve it but I am not able to find the passwd file under /splunk/etc directory
Please help me on this.

[chippysplunk]

I renamed Password file into password.bak and restarted splunk.
Still I am not able to login with "admin/changeme".

[MITHCHAND]

!- This is for Windows 7 -!

1. Open cmd and goto c:\Program Files\Splunk\bin>

2. Stop splunk service using the command
   c:\Program Files\Splunk\bin> splunk stop

3. Reset the admin password using the command as below
   c:\Program Files\Splunk\bin>splunk edit user admin -password newPassword -role admin -auth admin:changeme

4. Start the splunk service
   c:\Program Files\Splunk\bin> splunk start

5. Open URL https://localhost:8000 and user the credentials as admin/newPassword

[owaisenfo]

Hi, This question has been asked several times because the answer is bit confusing. It says moving passwd file to passwd.bak. What does this mean??

I can find passwd file but what is this passdw.bak? and where to find it, must be a folder where this file will be moved? Or do we have to just change the fle extension?

Please help, Thanks.

[chskm]

Hi Owaisenfo,

It's nothing but to rename to the passwd file to passwd.bak

Saikrishna

[bmunson_splunk]

This is an old answer and only works prior to V7.1. For all other versions read cbreshears_splunk Answer

Yes. Just rename it with a .bak extension, restart and use the default password of "changeme"

[chskm]

Hi Owaisenfo,

It's nothing but to rename to the passwd file to passwd.bak

Saikrishna

[reddyo]

JUst rename the passwd file and restart 🙂

[matt]

To reset the admin password you will need to have access to the file system:
- move the $SPLUNK_HOME/etc/passwd file to passwd.bak
- restart splunk. After the restart you should be able to login using the default login (admin/changeme).

If you created other user accounts, copy those entries from the backup file into the new passwd file and restart splunk.

[mspuranik]

Hey, I tried this but it does not seem to work. It says wrong password upon entering 'changeme'. By 'moving' passwd to passwd.bak do you mean renaming it? (I'm using Windows OS, not using any command shell). Please help.

[bpitts2]

Yes, you need to rename the file and then restart the splunk service.

[eappan]

If you are installing a splunk server (search, index, deploy) likely the splunk client software is running and using the same port. You need to remove the the following file:

mv /opt/splunkforwarder/etc/passwd /opt/splunkforwarder/etc/passwd.bak

Or

On Ubuntu
dpkg -l splunkforwarder (list the package)
dpkg -r splunkforwarder (remove the package)

Try login after, it should take admin/changeme.

[joposos]

I cannot find a passwd file under $SPLUNK_HOME/etc. I'm unable to login to splunk the first time itself with admin and change me credentials

Jophy

[tirher]

It´s very simple 😉

Thanks brother !!

[jdomin30]

I have mac, would it be the same for me?

[Junnilly]

I know iSeePassword windows password recovery program can reset password for Widows 7,8 and 10.
but you need a USB or DVD.
ttp://www.iseepassword.com/how-to-reset-windows-7-password.html