Related Answers
Download topic as PDF
Delete all user accounts
Remove all the user data (user accounts) from your Splunk Enterprise installation by typing ./splunk clean followed by the userdata argument. This deletes all the user accounts and you are required to create new admin user credentials.
Removing user data is irreversible. If you accidentally delete user data, you must recreate the accounts manually. Additionally, you must satisfy any password requirements that are in place when you recreate the accounts.
To remove all of the user accounts in the system:
./splunk clean userdata
To remove the user accounts in the system and skip the confirmation prompt:
./splunk clean userdata -f
To recreate the default admin account:
In Splunk Enterprise 7.1.0 and later, the default admin account is no longer automatically recreated on startup after running ./splunk clean userdata or ./splunk clean all.
To recreate the admin account, you can create a $SPLUNK_HOME/etc/system/local/user-seed.conf file with the following information before restarting Splunk Software.
[user_info] USERNAME = admin PASSWORD = <your new password>
|
PREVIOUS Find existing users and roles |
NEXT Secure access for Splunk knowledge objects |
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.1.0, 8.1.1, 8.1.2, 8.1.3
Feedback submitted, thanks!