Security

Why am I unable to login to freshly installed Splunk Enterprise (just reloads login page)?

dsalazar1
New Member

On a fresh Splunk Enterprise install, I cannot log in to the web GUI. When I get the password wrong, I am told it is wrong. When I get the password right, it just reloads the login page.

Here are the symptoms:
- Fresh Install of Splunk 8.0.1 (Have also tried 8.0.0 and 7.3.4)
- During startup, I have set a strong password (another post mentioned in 7.1+ it enforces strong passwords, so I tried this)
- No errors on install
- From web GUI (localhost:8000), when I try my username and password, the login screen simply reloads. When I try a known incorrect password, I get a notification that "Login Failed." So, I am led to believe that my password declared during install is actually recognized since I am not told the login failed when I enter the correct password...but I can't get past the login page.

Here's what I have tried so far:
-Uninstalled and reinstalled Splunk Enterprise 8.01, 8.00, and 7.3.4.
-Tried weak and strong passwords.
-Tried default admin / changeme combo. But again, when I get the password wrong, I am told it is wrong. When I get the password right, it just reloads the login page.
- Tried to reset admin password by renaming /etc/passwd to /etc/passwd.bak and then creating a new file called user-seed.conf in /etc/system/local with [user_info] PASSWORD = "my strong password"
- Also tried to reset password with "splunk cmd splunkd rest -noauth POST /services/admin/users/admin "password=changeme"

I am running on Windows 10. Of note, I have run Splunk 8.0.0 on this laptop before. I had the 60 day trial, switched to the free license group, but when I did that I had license violations leftover from when I used it is the 60 day trial. Since I was not able to search because of the violations, I re-installed from scratch (I didn't have much data ingested so I didnt mind) but this is when I stopped being able to login and have had this issue ever since. When I uninstall Splunk I verify that there are no files left in C:\Program Files. (i.e. no Splunk directory anymore)

Has anyone seen this issue before? Anyone know a way past it?

Labels (2)
Tags (2)
0 Karma

Janaji
Observer

Clearing cache on the browser solved this issue for me.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...