Splunk frequently asked questions!!!

By | April 5, 2019

Question – How often does the forwarder send data to indexer?
Answer – The forwarder sends data immediately when it becomes available. There is no certain interval that it waits or anything like that. but since it can send in blocks and set source type it must be waiting at least for an end of line, or for a file to not change over some time interval. Like, send changes if file has not update in 1 second.

Question – How do I reset splunk admin password?
Answer – If you forgot your admin password you will need access to the file system that Splunk is running on in order to modify the password file. To reset the admin password:

  • Move the $SPLUNK_HOME/etc/passwd file to $SPLUNK_HOME/etc/passwd.bak
  • Restart Splunk. After the restart you should be able to login using the default login (admin/changeme).
  • If you created other user accounts, copy those entries from the backup file into the new passwd file and restart splunk.