- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Enterprise 9.4.0 Integrity Check warning
After upgrade from 9.3.1 to 9.4.0 in windows platform, there is a warning shows 41 files that did not match.
After validate files, it shows the following query. How to solve the warning?
C:\Program Files\Splunk\bin>splunk.exe validate files Validating installed files against hashes from 'C:\Program Files\Splunk\splunk-9.4.0-6b4ebe426ca6-windows-x64-manifest' Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-console-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-datetime-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-debug-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-errorhandling-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l2-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-handle-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-heap-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-interlocked-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-libraryloader-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-localization-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-memory-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-namedpipe-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processenvironment-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-1.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-profile-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-rtlsupport-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-string-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-sysinfo-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-timezone-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-util-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-conio-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-convert-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-environment-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-filesystem-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-heap-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-locale-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-math-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-multibyte-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-private-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-process-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-runtime-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-stdio-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-string-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-time-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-utility-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/ucrtbase.dll': The system cannot find the file specified.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can disable those integrity checks as well if your Splunk environment is working fine after upgrade. To disable the file integrity check, edit the installed_files_integrity setting in the limits.conf file
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which Windows OS?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Windows version is Windows 11 Pro 23H2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please keep in mind that Splunk docs no longer specify support for Windows 10/11, only specifically server version. Something may have impacted the install extraction process.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have upgraded Splunk from version 9.3.1 to 9.4.0 on a Linux platform and observed this warning. However, Splunk is functioning properly, and no issues have been noticed post-upgrade. I believe the warning can be safely removed.
I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Splunk Enterprise is running in the customer environment, and I can't simply disable the integrity check and claim that it has no impact on Splunk's functionality
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't have Splunk running on a windows machine so I can't comment on whether those files are necessary or not, but if you find that your splunk installation is working well without those files and then you would like to just disable the warning, then you can remove the related lines in the manifest file in your splunk directory to disable the integrity checking on them.