Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Reset Password for Splunk Account for Cloud Collectors

Active background jobs continue running even after you stop cloud collectors from the user interface. If you reset the password while these jobs run with old credentials, the system will lock the account and stop data collection. Before resetting your password, understand these critical Cloud Collectors behaviors:

  • Background Processing: Cloud Collectors process data through backend jobs that may continue running after collectors are stopped via the user interface.

  • Cached Credentials: Active background jobs retain and use old password data.

  • Account Lockout: Repeated authentication failures automatically lock the Splunk account.

  • Authentication Failures: Resetting Splunk account passwords during active jobs causes repeated authentication failures.

  • Data Disruption: Multiple failed authentication attempts may trigger a Splunk account lockout. These lockouts immediately stop all active data collection.

Use the following best practices when resetting the Splunk account password used by Cloud Collectors. These steps prevent authentication failures and unexpected account lockouts in high-volume production environments.

  • Option 1 (Recommended): Use a New Splunk Account

  • Option 2: Reset Password of Existing Account (Planned Downtime Required)

Use a New Splunk Account

This approach is recommended for high-volume production environments. Following are the benefits of this approach.

  • Zero Lockout Risk: Eliminates account lockouts.

  • Continuous Data Ingestion: Maintains uninterrupted, ongoing data ingestion.

  • Maximum Safety: Provides the safest approach for live production systems.

Use the following steps to use new Splunk account credentials.

  1. Create a new Splunk service account.

  2. Update the cloud collector configuration to use the new account credentials.

  3. Start the Cloud Collectors and confirm that data ingestion is working correctly.

  4. Allow sufficient time (for example, several hours) for any remaining backend jobs using the old account to complete.

  5. Disable or remove the old Splunk account after confirming stable operation.

Reset Password of Existing Account

Use this approach only when creating a new account is not possible.

  1. Stop all Splunk Cloud Collectors from the user interface (UI).

  2. Ensure that you do not reset the password immediately after stopping collectors.

  3. Wait for background jobs to finish before updating your password. This prevents running processes from failing by attempting to log in with your old credentials.

    As a general rule, wait at least twice the duration of your typical job execution or data ingestion cycle.

    • Test Environments (low‑volume): 30–60 minutes.

    • Production Environments (high‑volume): 90 minutes or more.

  4. (Optional) Check the Last Log Received indicator as a reference. Note that this indicator does not guarantee completion of all background jobs.

  5. Reset the Splunk account password.

  6. Update the Cloud Collector configuration with the new password.

  7. Restart Cloud Collectors and monitor data ingestion.

    Note

    Background jobs may continue authenticating with your old password. Resetting your password too soon can cause authentication issues and may lock your account.

Practices to Avoid

Avoid the following actions to prevent disruption and account lockouts.

  • Immediate Password Resets: Avoid resetting the Splunk account password right after stopping the cloud collectors.

  • Background Process Verification: Do not assume a 'Stopped' status on the ser interface means all background processing has finished. Verify that all background processing is complete.

  • Single Collector Testing: Never test password changes on a single collector in high-volume environments, as a lockout impacts all collectors that share the same account.

Summary of Recommendations

Select the appropriate action based on your specific environment.

  • Production and High-Volume Environments: Create and switch to a new account to maintain stability.

  • Minimal Downtime Requirements: Create a new account first, then decommission the old account later.

  • Low-Volume or Test Environments: Proceed with a standard password reset after waiting for the recommended time.

Splunk Account Lockout Recovery

Use the following steps to recover safely if repeated authentication failures lock the Splunk account used by cloud collectors.

  1. Stop cloud collectors: Stop all cloud collectors from the user interface to block new collector jobs.

  2. Delay Password Changes: Avoid an immediate password reset, which prolongs the lockout.

  3. Wait for Retries: Wait until collector retry cycles are exhausted before taking further action. Pause up to 90 minutes for high-volume environments to let background retries finish.

  4. Verify Unlock: Confirm on the Splunk side that the account is no longer locked.

  5. Select a recovery path.

    • Preferred: Create a new Splunk service account and update Cloud Collectors to use the new credentials.

    • Alternative: Reset the password of the existing account only after backend retries have completed.

  6. Restart Collectors and Monitor Ingestion: Restart cloud collectors and verify data ingestion before decommissioning old credentials.

    Note

    Account lockouts affect all collectors sharing that account; therefore, creating a new service account ensures the fastest and safest recovery for production environments.

    To avoid service interruptions caused by backend processing behavior, use a new account when updating credentials in production environments.