Limited Time Offer!

For Less Than the Cost of a Starbucks Coffee, Access All DevOpsSchool Videos on YouTube Unlimitedly.
Master DevOps, SRE, DevSecOps Skills!

Enroll Now
Splunk

Splunk frequently asked questions!!!

April 5, 2019 Leave a Comment

Question – How often does the forwarder send data to indexer?
Answer – The forwarder sends data immediately when it becomes available. There is no certain interval that it waits or anything like that. but since it can send in blocks and set source type it must be waiting at least for an end of line, or for a file to not change over some time interval. Like, send changes if file has not update in 1 second.

Question – How do I reset splunk admin password?
Answer – If you forgot your admin password you will need access to the file system that Splunk is running on in order to modify the password file. To reset the admin password:

  • Move the $SPLUNK_HOME/etc/passwd file to $SPLUNK_HOME/etc/passwd.bak
  • Restart Splunk. After the restart you should be able to login using the default login (admin/changeme).
  • If you created other user accounts, copy those entries from the backup file into the new passwd file and restart splunk.

Alternate Method

$ ./bin/splunk stop

$ vi  etc/passwd
:admin:$6$UDQnslwGLUi/WwhL$/Sf44s..6.V/dlaFLcQmZzJ5A1WG.7aayvTaTsw/ji0gonm00N5hGqvAfwDlq8DAqHUyb
68OKsqMOQ.x05Hbm0::Administrator:admin:changeme@example.com:::18423

$ ./bin/splunk start

$ ./bin/splunk login

Validate using admin/admin123
Rajesh Kumar
Follow me
Latest posts by Rajesh Kumar (see all)
Subscribe
Notify of
guest
0 Comments
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x