https://community.splunk.com/t5/Getting-Data-In/How-to-fix-the-missing-spec-file-errors/m-p/165298#M98132 <P>I suspect that your "synchronization" is broken. What do you mean by that? </P> <P>The files that you show are basic configuration files that your splunk instance needs. In particular the files in the /opt/splunk/etc/system/default directory are important and should not be changed.</P> <P>If you are attempting to replicate changes between Splunk instances, you should leave the default directories alone.<BR /> As for how to recover, you could restore them from a backup if you have one. Or you could reinstall Splunk. <BR /> Depending on how badly the synchronization has damaged your Splunk instances, reinstallation might be the best route to a stable and correct Splunk.</P> Fri, 24 Apr 2015 17:06:19 GMT lguinn2 2015-04-24T17:06:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-fix-the-missing-spec-file-errors/m-p/165297#M98131 <P>Hi, </P> <P>I currently have four instances of Splunk, which are synchronised on a daily basis (the first instance pushes updates to the rest). </P> <P>A couple of days ago I noticed that the regex for two extracted fields have changed somehow so the searches wouldn't work anymore. When I altered the regex for them, everything worked fine until the next day - I realised that the changes have completely reverted after splunk service restarted. I also found these error messages when I ran "./splunk btool check --debug " (there are more of them, for all splunk users):</P> <P>No spec file for: /opt/splunk/etc/apps/user-prefs/default/user-<BR /> No spec file for: /opt/splunk/etc/system/default/conf.conf<BR /> No spec file for: /opt/splunk/etc/system/default/datatypesbnf.c<BR /> No spec file for: /opt/splunk/etc/system/default/default-mode.c<BR /> No spec file for: /opt/splunk/etc/system/default/prefs.conf</P> <P>Not sure if that's the reason for why changes are not saved or if it's just a separate issue, but I would still like to fix these.</P> <P>Can anyone help, please? </P> <P>What are spec files and could I possibly recover them if they were lost maybe, etc?</P> <P>Thank you and have a great weekend <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 24 Apr 2015 15:05:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-fix-the-missing-spec-file-errors/m-p/165297#M98131 kasia24 2015-04-24T15:05:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-fix-the-missing-spec-file-errors/m-p/165298#M98132 <P>I suspect that your "synchronization" is broken. What do you mean by that? </P> <P>The files that you show are basic configuration files that your splunk instance needs. In particular the files in the /opt/splunk/etc/system/default directory are important and should not be changed.</P> <P>If you are attempting to replicate changes between Splunk instances, you should leave the default directories alone.<BR /> As for how to recover, you could restore them from a backup if you have one. Or you could reinstall Splunk. <BR /> Depending on how badly the synchronization has damaged your Splunk instances, reinstallation might be the best route to a stable and correct Splunk.</P> Fri, 24 Apr 2015 17:06:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-fix-the-missing-spec-file-errors/m-p/165298#M98132 lguinn2 2015-04-24T17:06:19Z