File Integrity Checks Post Upgrade to 9.3

Available Languages

Updated:September 29, 2026
Document ID:SPLK047290

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

There is a failed file integrity check for /opt/splunk/bin/jp.py that results in "present_but_shouldnt_be". This error in integrity appeared after updating from 9.1 to 9.3 just a day prior. There is no reference to the script in the manifest or online in the Splunk community. Is it safe to remove this script or is there a way to remedy this in another fashion?


Investigation

The only change was a recent upgrade from 9.1 to 9.3 which then immediately see failed file integrity check for /opt/splunk/bin/jp.py that results in "present_but_shouldnt_be".

Resolution

The error 'present_but_shouldnt_be' indicates that the file /opt/splunk/bin/jp.py is not part of the expected file set for the version of Splunk 9.3 after the upgrade.
 
In fact, this script is not part of the standard Splunk ver 9.3 installation, but it is from a previous version of Splunk (stemming from version 8 which uses the previous python version 2). This file and others like these types of files are getting flagged in 9.3 because Splunk Enterprise 9.3 uses the Python 3.9 interpreter by default. 

To resolve this error with file integrity check, remove that file from that path which would be safe to do, especially if the file is not referenced or used elsewhere in the current setup.
  
1. Backup and remove the file since the file is not part of the expected distribution 
 
sudo cp /opt/splunk/bin/jp.py /opt/splunk/bin/jp.py.backup
2. After backing up, remove the file:
 
sudo rm /opt/splunk/bin/jp.py

 

Alternatively, move it to a different location outside of /opt/splunk/ so if any issues arise, it may be easily restored.
3. Re-run the file integrity check to ensure there are no other issues:
 
sudo /opt/splunk/bin/splunk validate files
4. After removing the file, from each instance in a distributed and clustered environment, each instance running these problematic files, needs to be restarted, ie, splunkd process needs a restart.
4.1. monitor your Splunk instance to ensure that there are no operational issues.

Removing Python 2.7 from your Splunk Enterprise deployment

 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles