Splunk custom script with python and pip library | Integrity check of installed files failed

[GaetanVP]

Hello Splunkers,

I recently created a custom alerts on my Search Head, and for this alert to run I needed to install a Pip library (here HttpNtlmAuth).

I used this command : 

/opt/splunk/bin/python3.7 -m pip install <my_package>

Afterwards my script & alert just ran correctly but the health check "Integrity check of installed files" failed because of this install (Splunk is complaining that my python bin and lib have changed, some other are missing).

I have read that I can install manually the Python package, but I would have the same integrity check problems right ?

Thanks for your answers,
GaetanVP

[richgalloway]

You're getting the integrity check messages because you altered the files that came with Splunk.  The fix is to re-install Splunk so you have the original file set.

Avoid the problem by putting the HttpNtimAuth library (and any others you need that do not come with Splunk) in the lib directory of your custom app.

[GaetanVP]

Thanks for your answer @richgalloway, I will try that !
About the re-install Splunk, I would definitely lose some configuration / files and so on... right ? No way to fixed the issue within s Splunk tool / cli ?

Thanks.
GaetanVP

[richgalloway · Accepted solution]

Just like one can upgrade Splunk without losing any configurations, one can re-install the same version without losing any configurations.  Backup $SPLUNK_HOME/etc to be safe.

You also can restore the individual files you overwrote by extracting them from the Splunk tarball.