How to Reset the Forgotten Password of Admin in Splunk

How to Reset the Forgotten Password of Admin in Splunk

Suppose someone is the admin of the Splunk and he has forgotten the password.

In the earlier version of Splunk, the Splunk Default Password was “Changeme” and User Name was “Admin” but now they have made the user to set their own password at the time of installation. That is the reason if they forget their own  password then we need to follow the below steps.

Now we will show you how to reset the password of admin very easily.

Step 1:

Open the command prompt/terminal of your system. Find the passwd file( $SPLUNK_HOME/etc/passwd ) of Splunk and rename it as passwd.bk.

# cd /opt/splunk/etc

# ls

# mv /opt/splunk/etc/passwd  /opt/splunk/etc/passwd.bk

Step 2:

Create a .conf file names user-seed.conf  in your $SPLUNK_HOME/etc/system/local directory.

# cd /opt/splunk/etc/system/local

# vi user-seed.conf

[user_info]

USERNAME=admin

PASSWORD=<new_password>

In the above screen shot  user name is admin  and new password is 12345678.

After adding this file and restart Splunk then you will be able to login in your system with your new password what you have mentioned in the user-seed.conf file.

# /opt/splunk/bin/splunk restart

Also the you can see that new passwd file will be created in the $SPLUNK_HOME/etc directory.

Step 3:

If there are users previously created by you and they know their own credentials then copy and paste their credentials from the passwd.bk file to new passwd file and then restart Splunk. You have to copy and paste all the credentials of existing users except admin.

 # /opt/splunk/bin/splunk restart

So finally we have reset the password  of the admin in Splunk.

Now, there is no concept of Splunk Default Password lies anymore because of the Security purpose. Users have to set their own password at the time of installation and follow this blog if they happen to reset their own password.

Hope, this has helped you in achieving the below requirement without fail:

How to Reset the Forgotten Password of Admin in Splunk

Happy Splunking  !!