Splunk Enterprise

Getting file integrity check for splunk file

pankajupadhyay
Path Finder

HI I am getting the below error.

But I do not make changes in default location but still i got this issue.

Can someone please help me to resolve this ?

 

How we can resolve this issue, ?

 

Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk/splun k-7.2.5.1-962d9a8e1586-linux-2.6-x86_64-manifest'
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/alert _actions.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/app.c onf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/colle ctions.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/comma nds.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/input s.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/macro s.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/props .conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/restm ap.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/saved searches.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/searc hbnf.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/telem etry.conf': No such file or directory
Could not open '/opt/splunk/splunk/etc/apps/splunk_instrumentation/default/web.c onf': No such file or directory
Problems were found, please review your files and move customizations to local

 

 

Thanks

Regards

Pankaj

0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust
Yes that should fix it. Try to find the reason why it has been removed.

View solution in original post

0 Karma

pankajupadhyay
Path Finder

@soutamo  I have checked and splunk_instrumentation this directory is missing but i do not how.

Yeah i do have similar version instance so can i copy that directory from there and it can resolve this issue.

 

Please correct me if i am wrong.

 

 

0 Karma

soutamo
SplunkTrust
SplunkTrust
Yes that should fix it. Try to find the reason why it has been removed.

View solution in original post

0 Karma

pankajupadhyay
Path Finder

@soutamo  Thanks for your help.

 

Yes problem has been resolved and i will try to find how that file has been removed from that location.

 

0 Karma

soutamo
SplunkTrust
SplunkTrust
Hi
this said that you haven't those files under /opt/splunk/etc/apps/splunk_instrumentation/default folder. Or other option is that "splunk user" haven't access rights to those.

Check that those exists and if then check access rights.
And if those are not there then you must get those there. At least two options: copy from another node if you have identical version or install again from installation package of same version which you have there. And remember the 2020 fix as your version is not at least. 7.2.9.1.
r. Ismo
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!