How to login into Splunk using local Splunk accounts
Available Languages
Applicability
Splunk Enterprise Splunk CloudDescription
Splunk is configured with SAML SSO, so authentication goes through a login URL, and local Splunk accounts can't authenticate.This may need to be done for accessing SplunkWeb on Splunk instances by local users/admins, especially in the case that SAML is not working (service may be down or misconfigured).
Investigation
SAML SSO is configured for Splunk and there's a need to login using a local Splunk account via SplunkWeb.Resolution
Local Splunk authentication/login is available via the Splunk Instance's FQDN and port in the following format:fqdn:splunkport/en-US/account/login?loginType=splunk
Where "/en-US/account/login?loginType=splunk" is added at the end of the Splunk Instance servername or location and port for login (e.g. servername:8000 or server_ip:8000).
Example:
If you're trying to login to a Splunk instance that has the FQDN of: splunksh01.buttercupgames.com, you'd normally try to login via port 8000 as splunksh01.buttercupgames.com:8000/
In the case of SAML SSO being configured, it becomes: splunksh01.buttercupgames.com:8000/en-US/account/login?loginType=splunk
For Splunk Cloud, the Local Splunk authentication/login URL is stackid.splunkcloud.com/en-US/account/login?loginType=splunk
In the case of SAML SSO being configured, it becomes: splunksh01.buttercupgames.com:8000/en-US/account/login?loginType=splunk
For Splunk Cloud, the Local Splunk authentication/login URL is stackid.splunkcloud.com/en-US/account/login?loginType=splunk
Related Links
Splunk Local Account Login when SAML authentication is enabled
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
28-Sep-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)