Splunk Search

Splunk custom script with python and pip library | Integrity check of installed files failed

GaetanVP
Contributor

Hello Splunkers,

I recently created a custom alerts on my Search Head, and for this alert to run I needed to install a Pip library (here HttpNtlmAuth).

I used this command : 

/opt/splunk/bin/python3.7 -m pip install <my_package>

Afterwards my script & alert just ran correctly but the health check "Integrity check of installed files" failed because of this install (Splunk is complaining that my python bin and lib have changed, some other are missing).

I have read that I can install manually the Python package, but I would have the same integrity check problems right ?

Thanks for your answers,
GaetanVP

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like one can upgrade Splunk without losing any configurations, one can re-install the same version without losing any configurations.  Backup $SPLUNK_HOME/etc to be safe.

You also can restore the individual files you overwrote by extracting them from the Splunk tarball.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're getting the integrity check messages because you altered the files that came with Splunk.  The fix is to re-install Splunk so you have the original file set.

Avoid the problem by putting the HttpNtimAuth library (and any others you need that do not come with Splunk) in the lib directory of your custom app.

---
If this reply helps you, Karma would be appreciated.

GaetanVP
Contributor

Thanks for your answer @richgalloway, I will try that !
About the re-install Splunk, I would definitely lose some configuration / files and so on... right ? No way to fixed the issue within s Splunk tool / cli ?

Thanks.
GaetanVP

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just like one can upgrade Splunk without losing any configurations, one can re-install the same version without losing any configurations.  Backup $SPLUNK_HOME/etc to be safe.

You also can restore the individual files you overwrote by extracting them from the Splunk tarball.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...