Getting Data In

How to reset 'props.conf' to defaults w/o reinstalling Splunk?

timfrostmann
Engager

Hi all,

I have Splunk on Windows 10.
I fiddled recently with some properties in "C:\Program Files\Splunk\etc/system/default/props.conf" but later I restored them to defaults (or so I thought. I might well forget to reset some changes)
Now I have a problem with "File Integrity Check": "props.conf" 's Check result is "differs"

I'd like to reset the file to defaults, desirably w/o reinstalling Splunk but maybe I should just ignore the notification?

Many thanks,
Tim

0 Karma
1 Solution

hardikJsheth
Motivator

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Now you know why the top of the file has a warning about not modifying the file.
Had you made your changes to $SPLUNK_HOME\etc\system\local\props.conf you could have returned to the default settings by deleting local\props.conf.

---
If this reply helps you, Karma would be appreciated.

hardikJsheth
Motivator

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...