Dashboards & Visualizations

restore a default file that is failing integrity check

andyfrank
Explorer

So after a system crash, I reboot and now I'm getting the warning:
Installed Files Integrity Checker: File Integrity checks found 1 files that did not match the system-provided manifest.

checking the link I learn that /opt/splunk/etc/system/default/web.conf is not passing the integrity check.
I can also confirm this by running ./splunk validate files
Great, now what?

Every thread I found talking about this just says how to find the file, but none say how to actually FIX this.

How do I restore a default file that is failing integrity check?

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Download the Splunk tarball for your version.

Use tar to extract the needed file.

tar -zxf <downloaded file name> splunk/etc/system/default/web.conf -C ~

Rename the existing web.conf file.

mv /opt/splunk/etc/system/default/web.conf ~/web_conf.bad

Move the extracted file into position.

mv ~/web.conf /opt/splunk/etc/system/default

Restart Splunk and the error should go away.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Download the Splunk tarball for your version.

Use tar to extract the needed file.

tar -zxf <downloaded file name> splunk/etc/system/default/web.conf -C ~

Rename the existing web.conf file.

mv /opt/splunk/etc/system/default/web.conf ~/web_conf.bad

Move the extracted file into position.

mv ~/web.conf /opt/splunk/etc/system/default

Restart Splunk and the error should go away.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

andyfrank
Explorer

Yes ! Thank you this is exactly what I wanted, nicely formatted and all. You rock!

for anyone reading this, here is the link for previous releases:
https://www.splunk.com/page/previous_releases

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

You can restore the default file from a clean installation of Splunk, if the error message is caused by you making changes to any files in the default Splunk directories and you don't have a backup of the original file.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!