Security

ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin

sbhat13
New Member

Hi,
We noticed the disk space is crossing the threshold >85% for the /opt/splunk mount point in one of our Dev Splunk AWS instance.On checking we are getting multiple error entries in splunkd.log for authentication failure as below.
We did try to reset the admin password to check if it resolves as per https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html but it did not help.

Please let us know what is the reason for the issue.
08-22-2016 09:37:21.345 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin
08-22-2016 09:37:21.397 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin

Error entries in audit log
08-22-2016 09:52:33.442 -0400 INFO AuditLogger - Audit:[timestamp=08-22-2016 09:52:33.442, id=22436721, user=admin, action=login attempt, info=failed][CVflHg3ekijQ+pPJxiiEPzHYxYkf6URGn8U7moMrgcezqbmJYnZjkFtn/KS4sIfb5Di91lblaZlmTaymQj4ey21AhyUUOR5t7Vyr81wcovG1vLSUN0OWLu3uuHn1oUFNysW9u29gMa0dMIzQ7Apv+gjL00GtMWX6Rr9WW46lhDc

Please let me know if there is anyway to resolve this.

Thanks,
Soumya

Tags (1)
0 Karma

adilsonbna
New Member

I've got the same issue. It not admin password from Splunk server. Login admin and password is default by client one.

I just used command
./splunk add forward-server :9997

Splunk username: admin
Password: changeme
Added forwarding to: xx.xx.xx.xxx:9997.

It works!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...