Splunk Enterprise 9.4.0 Integrity Check warning

Alan_Chan — Fri, 03 Jan 2025 03:57:59 GMT

After upgrade from 9.3.1 to 9.4.0 in windows platform, there is a warning shows 41 files that did not match.

After validate files, it shows the following query. How to solve the warning?

C:\Program Files\Splunk\bin>splunk.exe validate files
Validating installed files against hashes from 'C:\Program Files\Splunk\splunk-9.4.0-6b4ebe426ca6-windows-x64-manifest'
Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-console-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-datetime-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-debug-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-errorhandling-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-2-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l2-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-handle-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-heap-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-interlocked-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-libraryloader-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-localization-l1-2-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-memory-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-namedpipe-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processenvironment-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-1.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-profile-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-rtlsupport-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-string-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-2-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-sysinfo-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-timezone-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-util-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-conio-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-convert-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-environment-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-filesystem-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-heap-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-locale-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-math-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-multibyte-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-private-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-process-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-runtime-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-stdio-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-string-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-time-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-utility-l1-1-0.dll': The system cannot find the file specified.

Could not open 'C:\Program Files\Splunk\bin/ucrtbase.dll': The system cannot find the file specified.

Re: Splunk Enterprise 9.4.0 Integrity Check warning

marnall — Fri, 03 Jan 2025 22:10:15 GMT

I don't have Splunk running on a windows machine so I can't comment on whether those files are necessary or not, but if you find that your splunk installation is working well without those files and then you would like to just disable the warning, then you can remove the related lines in the manifest file in your splunk directory to disable the integrity checking on them.

Re: Splunk Enterprise 9.4.0 Integrity Check warning

kiran_panchavat — Mon, 06 Jan 2025 11:49:29 GMT

@Alan_Chan

I have upgraded Splunk from version 9.3.1 to 9.4.0 on a Linux platform and observed this warning. However, Splunk is functioning properly, and no issues have been noticed post-upgrade. I believe the warning can be safely removed.

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Re: Splunk Enterprise 9.4.0 Integrity Check warning

rishabhshah — Mon, 06 Jan 2025 13:25:53 GMT

You can disable those integrity checks as well if your Splunk environment is working fine after upgrade. To disable the file integrity check, edit the installed_files_integrity setting in the limits.conf file

Re: Splunk Enterprise 9.4.0 Integrity Check warning

dural_yyz — Mon, 06 Jan 2025 14:40:37 GMT

Which Windows OS?

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Alan_Chan — Tue, 07 Jan 2025 02:01:21 GMT

The Windows version is Windows 11 Pro 23H2

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Alan_Chan — Tue, 07 Jan 2025 02:05:03 GMT

The Splunk Enterprise is running in the customer environment, and I can't simply disable the integrity check and claim that it has no impact on Splunk's functionality

Re: Splunk Enterprise 9.4.0 Integrity Check warning

dural_yyz — Thu, 09 Jan 2025 21:24:20 GMT

Please keep in mind that Splunk docs no longer specify support for Windows 10/11, only specifically server version. Something may have impacted the install extraction process.

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Foolish_Rogue — Wed, 23 Apr 2025 12:13:05 GMT

Hello, I received this same error in upgrading from 9.3 to 9.4 versions of Splunk Enterprise. I found a helpful article posted by Splunk Support that resolved my issue. Please see the link below.

http://splunk.my.site.com/customer/s/article/File-Integrity-checks-found-41-files-that-did-not-match-the-system-provided-manifest

topic Splunk Enterprise 9.4.0 Integrity Check warning in Splunk Enterprise

Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning

Re: Splunk Enterprise 9.4.0 Integrity Check warning