Splunk Enterprise

Restore Splunk user account

uagraw01
Motivator


Hello Splunkers!!

After resetting my admin password, the users' accounts are gone and they are not visible in the UI. How can I restore all those user login accounts?

uagraw01_0-1717675148824.png

In the above picture from the backend I can see the users. but from the UI no user account is visible.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How did you reset the admin password?

---
If this reply helps you, Karma would be appreciated.
0 Karma

uagraw01
Motivator

@richgalloway Rename the passwrd file under /etc/system and change the password under user-seed.conf file for admin user.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I thought that was how it was done.  The user accounts are still in the renamed passwd file.  Put it back (after transferring the admin password from the new passwd file), restart, and the accounts should be restored.

---
If this reply helps you, Karma would be appreciated.

uagraw01
Motivator

 @richgalloway 

changed the file name twice while troubleshooting and now I think the original password file is lost.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If that's the case then you'll have to restore the file from a backup.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...