Dashboards & Visualizations

restore a default file that is failing integrity check

andyfrank
Explorer

So after a system crash, I reboot and now I'm getting the warning:
Installed Files Integrity Checker: File Integrity checks found 1 files that did not match the system-provided manifest.

checking the link I learn that /opt/splunk/etc/system/default/web.conf is not passing the integrity check.
I can also confirm this by running ./splunk validate files
Great, now what?

Every thread I found talking about this just says how to find the file, but none say how to actually FIX this.

How do I restore a default file that is failing integrity check?

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Download the Splunk tarball for your version.

Use tar to extract the needed file.

tar -zxf <downloaded file name> splunk/etc/system/default/web.conf -C ~

Rename the existing web.conf file.

mv /opt/splunk/etc/system/default/web.conf ~/web_conf.bad

Move the extracted file into position.

mv ~/web.conf /opt/splunk/etc/system/default

Restart Splunk and the error should go away.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Download the Splunk tarball for your version.

Use tar to extract the needed file.

tar -zxf <downloaded file name> splunk/etc/system/default/web.conf -C ~

Rename the existing web.conf file.

mv /opt/splunk/etc/system/default/web.conf ~/web_conf.bad

Move the extracted file into position.

mv ~/web.conf /opt/splunk/etc/system/default

Restart Splunk and the error should go away.

---
If this reply helps you, Karma would be appreciated.

andyfrank
Explorer

Yes ! Thank you this is exactly what I wanted, nicely formatted and all. You rock!

for anyone reading this, here is the link for previous releases:
https://www.splunk.com/page/previous_releases

s2_splunk
Splunk Employee
Splunk Employee

You can restore the default file from a clean installation of Splunk, if the error message is caused by you making changes to any files in the default Splunk directories and you don't have a backup of the original file.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...