Configure users with the CLI

You can use the Splunk CLI to manage local Splunk accounts on a Splunk Enterprise instance. You can use the CLI to add, edit, or delete users.

The CLI works for users that exist in the native Splunk authentication scheme only. The CLI cannot add, edit, or remove users when the Splunk Enterprise instance authenticates using other authentication schemes, such as the lightweight directory access protocol (LDAP) or security assertion markup language protocol (SAML) schemes.

Refer to the table to learn which Splunk CLI commands you can use to perform user management on your Splunk Enterprise instance.

Function	CLI command to use	Notes
Add users	splunk add user -username <username>	This command requires additional arguments: password: The password the user is to use. This password must meet the password eligibility requirements. role: At least one role that a user will hold. All users must hold at least one role.
Edit users	splunk edit user -username <username>	To modify roles for a user, use the roles command line argument. See the CLI help for details.
Remove users	splunk remove user -username <username>

The Splunk user CLI commands have context-specific command line arguments. For specific information on each of the command line arguments for each command, run the `splunk help user <command>` command.

If you are have not already authenticated into your Splunk Enterprise instance using the CLI, and do not supply those arguments to the CLI using the auth argument, the CLI prompts you for current credentials. You must provide those credentials for the user management commands to succeed.

Examples of user management using the CLI

Following are some examples of using the Splunk CLI to add, edit, and remove users in Splunk Enterprise. To prevent others from potentially having access to the credentials you gave the users, delete the command line history after you configure the users.

Action	CLI command	Notes
Add a new administrator user with the password "changeme2"	./splunk add user admin2 -password changeme2 -role admin -auth admin:changeme
Change an existing administrator user password to "fflanda"	./splunk edit user admin -password fflanda -role admin -auth admin:<password>	You must either escape or wrap single quotation marks around passwords that have special characters that the local shell or command prompt can interpret. For example: ./splunk edit user admin -password fflanda\$ -role admin -auth admin:<password> ./splunk edit user admin -password 'fflanda$' -role admin -auth admin:<password>
Remove an existing user "ninja"	./splunk remove user ninja -password -auth admin:<password>	This command is immediate, and can't be undone.