(help) splunk is not work after restart server

[lifekis]

I have mistake that deleted the configuration default file.
WebUI does not work properly after server restart.
What should I do?

deleted files
splunk/etc/apps/SplunkForwarder/*
splunk/etc/apps/SplunkLightForwarder/*
splunk/etc/apps/legacy/*
splunk/etc/apps/sample_app/*

[gcusello · Accepted solution]

Hi @lifekis,

it wasn't a good idea to delete some Splunk's default apps!

Anyway, you have three ways to restore your Splunk installation:

• take the deleted files from a backup if present;
• update Splunk to a following minor version (e.g. 8.1.1 to 8.1.2 or 7.3.3 to 7.3.4), if possible;
• take the deleted folders and files from another installation of the same version of Splunk (if you haven't it, make a new installation in another server or in the same but in a different folder).

The first two solutions are prefereable because quicker, but I don't know if they are possible in your installation, the third requires more work but it runs.

Ciao.

Giuseppe

[lifekis]

It was solved using the third method. Thanks.

[manjunathmeti]

You can force upgrade Splunk to the same version again to restore default apps and files.

If this reply helps you, an upvote/like would be appreciated.

[lifekis]

thanks, I will try.