Would you show steps on how to check / fix file integrity check errors on Splunk Ent. / ES

[SamHTexas]

How to check / fix file integrity check errors on Splunk Ent. / ES. Thank u

[richgalloway]

Splunk will find the files for you.  When it finds one you should see a message in the Messages dropdown.  Click on it for details.  The fix is to replace the file with the one from the installation tarball.

[SamHTexas]

Thank u sir for your message. The only description I found under check results column says " differs". So how severe of an issue is it sir not to deal with such errors? It seems like this error comes & goes (error goes away) from one server to another every few days. Thank u again.

[richgalloway]

"Differs" is all Splunk can say because it's just comparing the current hash value of the file to that which it has on record.  To find the actual difference, you'd have to compare it to a known-good copy of the file (from the tarball or your backup).

Usually, a difference is not an issue, but that depends on the actual change(s) in the file.  Perhaps someone added a custom format to datetime.xml or maybe they screwed it up and some timestamps will fail to match.

I don't know why the issue would come and go.