topic Re: How to reset 'props.conf' to defaults w/o reinstalling Splunk? in Getting Data In

How to reset 'props.conf' to defaults w/o reinstalling Splunk?

timfrostmann — Thu, 03 Aug 2017 09:03:32 GMT

Hi all,

I have Splunk on Windows 10.
I fiddled recently with some properties in "C:\Program Files\Splunk\etc/system/default/props.conf" but later I restored them to defaults (or so I thought. I might well forget to reset some changes)
Now I have a problem with "File Integrity Check": "props.conf" 's Check result is "differs"

I'd like to reset the file to defaults, desirably w/o reinstalling Splunk but maybe I should just ignore the notification?

Many thanks,
Tim

Re: How to reset 'props.conf' to defaults w/o reinstalling Splunk?

hardikJsheth — Thu, 03 Aug 2017 12:35:48 GMT

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html

Re: How to reset 'props.conf' to defaults w/o reinstalling Splunk?

richgalloway — Thu, 03 Aug 2017 13:06:21 GMT

Now you know why the top of the file has a warning about not modifying the file.
Had you made your changes to $SPLUNK_HOME\etc\system\local\props.conf you could have returned to the default settings by deleting local\props.conf.