Secure your admin account

Splunk with an Enterprise license has a default administration account and password, admin/changeme. Splunk recommends strongly that you change the default in order to keep your system secure. Your password should be complex and follow general password best practices:

• Use a combination of words, numbers, symbols, and both upper- and lower-case letters.
• Complexity is important, but length is vital. We recommend a minimum of 10 characters.
• Do not choose passwords based upon details that may not be as confidential as you'd expect, such as your birth date, your Social Security or phone number, or names of family members.
• Do not use words that can be found in the dictionary.
• Don't use a password you use or have used elsewhere.

Use Splunk Web

To change the admin default password:

1. Log into Splunk Web as the admin user.

2. Click Settings in the top-right of the interface.

3. Click Access controls in the Users and Authentication section of the screen.

4. Click Users.

5. Click the admin user.

6. Update the password, and click Save.

Use Splunk CLI

The Splunk CLI command is:

splunk edit user

Important: You must authenticate with the existing password before you can change it. Log into Splunk via the CLI or use the -auth parameter. For example, this command changes the admin password from changeme to foo:

splunk edit user admin -password foo -role admin -auth admin:changeme

Note: On *nix operating systems, the shell interprets some special characters as command directives. You must either escape these characters by preceding them with \ individually, or enclose the password in single quotes ('). For example:

splunk edit user admin -password 'FFL14io!23ur$' -role admin -auth admin:changeme

or

splunk edit user admin -password FFL14io!23ur\$ -role admin -auth admin:changeme

On Windows, use the caret (^) to escape reserved shell characters, or enclose the password in double-quotes ("). For example:

splunk edit user admin -password "FFL14io!23ur>" -role admin -auth admin:changeme

or

splunk edit user admin -password FFL14io!23ur^> -role admin -auth admin:changeme

Note: You can also reset all of your passwords across servers at once. See "Deploy secure passwords across multiple servers for the procedure.