Splunk Search

Splunk custom script with python and pip library | Integrity check of installed files failed

GaetanVP
Contributor

Hello Splunkers,

I recently created a custom alerts on my Search Head, and for this alert to run I needed to install a Pip library (here HttpNtlmAuth).

I used this command : 

/opt/splunk/bin/python3.7 -m pip install <my_package>

Afterwards my script & alert just ran correctly but the health check "Integrity check of installed files" failed because of this install (Splunk is complaining that my python bin and lib have changed, some other are missing).

I have read that I can install manually the Python package, but I would have the same integrity check problems right ?

Thanks for your answers,
GaetanVP

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like one can upgrade Splunk without losing any configurations, one can re-install the same version without losing any configurations.  Backup $SPLUNK_HOME/etc to be safe.

You also can restore the individual files you overwrote by extracting them from the Splunk tarball.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're getting the integrity check messages because you altered the files that came with Splunk.  The fix is to re-install Splunk so you have the original file set.

Avoid the problem by putting the HttpNtimAuth library (and any others you need that do not come with Splunk) in the lib directory of your custom app.

---
If this reply helps you, Karma would be appreciated.

GaetanVP
Contributor

Thanks for your answer @richgalloway, I will try that !
About the re-install Splunk, I would definitely lose some configuration / files and so on... right ? No way to fixed the issue within s Splunk tool / cli ?

Thanks.
GaetanVP

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just like one can upgrade Splunk without losing any configurations, one can re-install the same version without losing any configurations.  Backup $SPLUNK_HOME/etc to be safe.

You also can restore the individual files you overwrote by extracting them from the Splunk tarball.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...