Search peer idx message: File Integrity checks found files that did not match the system-provided manifest.

Applicability

Description

The following message appears under the message tab indicating integrity check issues.

Search peer idx-i-xxxxxx.splunkcloud.com has the following message: File Integrity checks found 4542 files that did not match the system-provided manifest. Review the list of problems reported by the InstalledFileHashChecker in splunkd.log File Integrity Check View ; potentially restore files from installation media, change practices to avoid changing files, or work with support to identify the problem. Learn more.

Learn more > File path > Check result: D:\Program Files\Splunk\bin\.srl present_but_shouldnt_be 

Investigation

These error messages usually come after an Upgrade.  The newer version of Splunk no longer needs the file that was kept, and displays the error as "shouldn't_be" in messages.

Most of these files are no longer required for the updated Splunk version and can be deleted.

In Splunk Cloud, users that have the role admin, or admin:admin will see these messages as well; which is unsupported, and sc_admin role should be use instead.

Resolution

1. Typically these messages show up for the Admin account. The "integrity check" message doesn't mean anything and can be ignored. It is a false positive and has to do with some default files not being in the manifest anymore. In Splunk Cloud it is important to check the roles and ensure that sc_admin is being used.
   
   
2. For Enterprise, to stop these errors from showing:
   Delete the file(s). The file path is detailed under Learn More in the message tab.
   Once the deletion is completed execute the following command to confirm the issue is resolved.

./splunk validate files

Related Links

Integrity files documentation