Configure users with the CLI

You can use the Splunk CLI to manage local Splunk accounts on a Splunk Enterprise instance. You can use the CLI to add, edit, or delete users.

The CLI works for users that exist in the native Splunk authentication scheme only. The CLI cannot add, edit, or remove users when the Splunk Enterprise instance authenticates using other authentication schemes, such as the lightweight directory access protocol (LDAP) or security assertion markup language protocol (SAML) schemes.

You must have administrator or equivalent access to manage users with the CLI. If you are have not already authenticated into your Splunk Enterprise instance, the CLI prompts you for those credentials. You must provide the credentials for the user management commands to succeed. You can use the auth argument to provide credentials manually

Refer to the table to learn which Splunk CLI commands you can use to perform user management on your Splunk Enterprise instance.

Function	CLI command to use	Notes
Add users	splunk add user -username <username>	This command requires additional arguments: password: The password the user is to use. This password must meet the password eligibility requirements. role: At least one role that a user will hold. All users must hold at least one role.
Edit users	splunk edit user -username <username>	To modify roles for a user, use the roles command line argument. See the CLI help for details.
Remove users	splunk remove user -username <username>

The Splunk user CLI commands have context-specific command line arguments. For specific information on each of the command line arguments for each command, run the splunk help user <command> command.

Examples of user management using the CLI

Following are some examples of using the Splunk CLI to add, edit, and remove users in Splunk Enterprise. To prevent others from potentially having access to the credentials you gave the users, delete the command line history after you configure the users.

Action	CLI command	Notes
Add a new administrator user with the password "changeme2"	./splunk add user admin2 -password changeme2 -role admin -auth admin:changeme
Change an existing administrator user password to "fflanda"	./splunk edit user admin -password fflanda -role admin -auth admin:<password>	You must either escape or wrap single quotation marks around passwords that have special characters that the local shell or command prompt can interpret. For example: ./splunk edit user admin -password fflanda\$ -role admin -auth admin:<password> ./splunk edit user admin -password 'fflanda$' -role admin -auth admin:<password>
Remove an existing user "ninja"	./splunk remove user ninja -password -auth admin:<password>	This command is immediate, and can't be undone.