How to reset 'props.conf' to defaults w/o reinstalling Splunk?

[timfrostmann]

Hi all,

I have Splunk on Windows 10.
I fiddled recently with some properties in "C:\Program Files\Splunk\etc/system/default/props.conf" but later I restored them to defaults (or so I thought. I might well forget to reset some changes)
Now I have a problem with "File Integrity Check": "props.conf" 's Check result is "differs"

I'd like to reset the file to defaults, desirably w/o reinstalling Splunk but maybe I should just ignore the notification?

Many thanks,
Tim

[richgalloway]

Now you know why the top of the file has a warning about not modifying the file.
Had you made your changes to $SPLUNK_HOME\etc\system\local\props.conf you could have returned to the default settings by deleting local\props.conf.

[hardikJsheth · Accepted solution]

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html