Question – How often does the forwarder send data to indexer?
Answer – The forwarder sends data immediately when it becomes available. There is no certain interval that it waits or anything like that. but since it can send in blocks and set source type it must be waiting at least for an end of line, or for a file to not change over some time interval. Like, send changes if file has not update in 1 second.
Question – How do I reset splunk admin password?
Answer – If you forgot your admin password you will need access to the file system that Splunk is running on in order to modify the password file. To reset the admin password:
- Move the $SPLUNK_HOME/etc/passwd file to $SPLUNK_HOME/etc/passwd.bak
- Restart Splunk. After the restart you should be able to login using the default login (admin/changeme).
- If you created other user accounts, copy those entries from the backup file into the new passwd file and restart splunk.
Alternate Method
$ ./bin/splunk stop
$ vi etc/passwd
:admin:$6$UDQnslwGLUi/WwhL$/Sf44s..6.V/dlaFLcQmZzJ5A1WG.7aayvTaTsw/ji0gonm00N5hGqvAfwDlq8DAqHUyb
68OKsqMOQ.x05Hbm0::Administrator:admin:changeme@example.com:::18423
$ ./bin/splunk start
$ ./bin/splunk login
Validate using admin/admin123
I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I am working at Cotocus. I blog tech insights at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at I reviewed , and SEO strategies at Wizbrand.
Please find my social handles as below;
Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at PINTEREST
Rajesh Kumar at QUORA
Rajesh Kumar at WIZBRAND
