Splunk Enterprise

Restore Splunk user account

uagraw01
Motivator


Hello Splunkers!!

After resetting my admin password, the users' accounts are gone and they are not visible in the UI. How can I restore all those user login accounts?

uagraw01_0-1717675148824.png

In the above picture from the backend I can see the users. but from the UI no user account is visible.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How did you reset the admin password?

---
If this reply helps you, Karma would be appreciated.
0 Karma

uagraw01
Motivator

@richgalloway Rename the passwrd file under /etc/system and change the password under user-seed.conf file for admin user.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I thought that was how it was done.  The user accounts are still in the renamed passwd file.  Put it back (after transferring the admin password from the new passwd file), restart, and the accounts should be restored.

---
If this reply helps you, Karma would be appreciated.

uagraw01
Motivator

 @richgalloway 

changed the file name twice while troubleshooting and now I think the original password file is lost.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If that's the case then you'll have to restore the file from a backup.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Holistic Visibility and Effective Alerting Across IT and OT Assets

Instead of effective and unified solutions, they’re left with tool fatigue, disjointed alerts and siloed ...

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...