Change the password for a data source

For security purposes, you may have a password management system or corporate requirement to periodically change your Splunk search head password. Your Splunk UBA data sources must also be edited to use any updated passwords as needed.

Run the change-ds-splunk-passwd.sh script in Splunk UBA to change a data source's password:

1. Log in to the management node of your Splunk UBA deployment as the caspida user.
2. Run the change-ds-splunk-passwd.sh command:

   /opt/caspida/bin/postinstall/change-ds-splunk-passwd.sh -u <username> -s <splunk_server:8089> -p '<new_password>'
   

   Be sure to include the single quotes around the new password. For example, to reset the password for the uba_svc data source to caspida123:

   /opt/caspida/bin/postinstall/change-ds-splunk-passwd.sh -u uba_svc -s  examplecompany.splunkcloud.com:8089 -p 'caspida123'
   

   Use the help option for the change-ds-splunk-passwd.sh command to view additional options:

   /opt/caspida/bin/postinstall/change-ds-splunk-passwd.sh -h

3. Stop and restart all the data sources.
   1. Run the following command to stop all data sources:

      /opt/caspida/bin/Caspida stop-datasources

   2. Wait a few minutes, then run the following command to restart the data sources:

      /opt/caspida/bin/Caspida start-datasources

   You can also restart each data sources from the Splunk UBA web interface:

   1. In Splunk UBA, select Manage > Data Sources.
   2. On the Data Sources page, select the data sources you want to start.
   3. Click Actions, then select Start.