Unlock a user account
If a user locks themself out of their Splunk instance account, an administrator can unlock the account.
To change a password for a Splunk instance user account, see Change a password.
Unlocking a user account applies when you use the native authentication scheme only. It does not apply when using other authentication schemes.
Unlock a user account in Splunk Web
If an administrator has locked themself out of their account, they must reset their password by using the "Unlock a administrator from the command line" procedure later in this topic.
- In Splunk Web, click Settings > Users.
- In the Users page, check the Status column to locate the user that is locked.
- In the Action column for that user, click Unlock. The user can log in immediately with the correct credentials.
Unlock a user account from the command line in Splunk Enterprise
A Splunk platform instance administrator can unlock an account if they have access to the CLI and write access to the disk on which the Splunk platform instance runs.
- Open a shell or command prompt.
- Type the following CLI command:
splunk edit user <locked username> -locked-out false -auth admin:<yourpassword>
- Exit the shell or command prompt.
- Try to log into the Splunk platform instance as the locked out user.
Unlock an administrator account from the command line in Splunk Enterprise
If a Splunk platform instance administrator needs to unlock the administrator account on an instance, they must have access to the disk on which the Splunk platform instance runs.
- Open a shell or command prompt.
- Stop The Splunk platform instance:
- Temporarily move the password file to a backup:
mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak
- Follow the instructions in Create admin credentials with user-seed.conf to recreate the administrator user.
- Confirm you can log into the instance with the new administrator username and password.
- After you confirm a successful log in to the instance, stop the instance again.
- Using a text editor, open both the backup password file and the new password file that the Splunk platform created when you created the new administrator user earlier in this procedure.
- Copy all of the user information, except for the administrator user, from the backup password file you created earlier to the new password file.
- Save the file and close the text editor.
- Restart the Splunk platform instance.
- Log into the Splunk platform instance.
About unlocking users accounts in distributed environments
If a user on a search head cluster is locked out, they are only locked out on the single member of the cluster. Results from other search heads will not show the user as locked out.
If a user or admin is locked out, an admin can:
- Wait for the user's lockout period to expire.
- Unlock the user, using the instructions on this page.
Password best practices for users
Change a user password
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0, 8.2.1