Getting Data In

How to reset 'props.conf' to defaults w/o reinstalling Splunk?

timfrostmann
Engager

Hi all,

I have Splunk on Windows 10.
I fiddled recently with some properties in "C:\Program Files\Splunk\etc/system/default/props.conf" but later I restored them to defaults (or so I thought. I might well forget to reset some changes)
Now I have a problem with "File Integrity Check": "props.conf" 's Check result is "differs"

I'd like to reset the file to defaults, desirably w/o reinstalling Splunk but maybe I should just ignore the notification?

Many thanks,
Tim

0 Karma
1 Solution

hardikJsheth
Motivator

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Now you know why the top of the file has a warning about not modifying the file.
Had you made your changes to $SPLUNK_HOME\etc\system\local\props.conf you could have returned to the default settings by deleting local\props.conf.

---
If this reply helps you, Karma would be appreciated.

hardikJsheth
Motivator

Download tar file of the splunk version that you are using and then copy past props.conf file from the same location of the extracted tar.
https://www.splunk.com/en_us/download/splunk-enterprise.html

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...