topic Re: (help) splunk is not work after restart server in Knowledge Management

(help) splunk is not work after restart server

lifekis — Fri, 19 Feb 2021 07:53:48 GMT

I have mistake that deleted the configuration default file.
WebUI does not work properly after server restart.
What should I do?

deleted files
splunk/etc/apps/SplunkForwarder/*
splunk/etc/apps/SplunkLightForwarder/*
splunk/etc/apps/legacy/*
splunk/etc/apps/sample_app/*

KakaoTalk_20210219_161439874.jpg

Re: (help) splunk is not work after restart server

manjunathmeti — Fri, 19 Feb 2021 07:59:35 GMT

You can force upgrade Splunk to the same version again to restore default apps and files.

If this reply helps you, an upvote/like would be appreciated.

Re: (help) splunk is not work after restart server

lifekis — Fri, 19 Feb 2021 08:01:04 GMT

thanks, I will try.

Re: (help) splunk is not work after restart server

gcusello — Fri, 19 Feb 2021 08:03:37 GMT

Hi @lifekis,

it wasn't a good idea to delete some Splunk's default apps!

Anyway, you have three ways to restore your Splunk installation:

take the deleted files from a backup if present;
update Splunk to a following minor version (e.g. 8.1.1 to 8.1.2 or 7.3.3 to 7.3.4), if possible;
take the deleted folders and files from another installation of the same version of Splunk (if you haven't it, make a new installation in another server or in the same but in a different folder).

The first two solutions are prefereable because quicker, but I don't know if they are possible in your installation, the third requires more work but it runs.

Ciao.

Giuseppe

Re: (help) splunk is not work after restart server

lifekis — Tue, 23 Feb 2021 04:28:34 GMT

It was solved using the third method. Thanks.