Splunk Enterprise

Restore Splunk user account

uagraw01
Motivator


Hello Splunkers!!

After resetting my admin password, the users' accounts are gone and they are not visible in the UI. How can I restore all those user login accounts?

uagraw01_0-1717675148824.png

In the above picture from the backend I can see the users. but from the UI no user account is visible.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How did you reset the admin password?

---
If this reply helps you, Karma would be appreciated.
0 Karma

uagraw01
Motivator

@richgalloway Rename the passwrd file under /etc/system and change the password under user-seed.conf file for admin user.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I thought that was how it was done.  The user accounts are still in the renamed passwd file.  Put it back (after transferring the admin password from the new passwd file), restart, and the accounts should be restored.

---
If this reply helps you, Karma would be appreciated.

uagraw01
Motivator

 @richgalloway 

changed the file name twice while troubleshooting and now I think the original password file is lost.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If that's the case then you'll have to restore the file from a backup.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...