Splunk Search

missing users.ini file

molinarf
Communicator

I have been getting a message that says that a file has been improperly modified or missing. The result of the integrity check says that that file that failed is users.ini that is located in /etc/users. Upon inspection of the folder the users.ini file is named users.ini.pre405 and its size is 0KB. This doesn't prevent Splunk from working, but just more of an annoyance right now. Can anyone help me with resolving this issue?

Thank you in advance.

Configuration:
Splunk 6.6.3
Windows 2012 R2
16 CPU Cores/32 Virtual CPU Cores
256 GB Memory
3TB disk space

Tags (1)
0 Karma

molinarf
Communicator

When I upgraded to version 7.0.0, the installation process created a new users.ini file. There is no issue now.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...