File Integrity Checks find 41 files that did not match the system-provided Manifest Messages found after upgrade
Here is the validate files command results:
c:\Program Files\Splunk\bin>splunk.exe validate files
Validating installed files against hashes from 'c:\Program Files\Splunk\splunk-9.4.0-6b4ebe426ca6-windows-x64-manifest'
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-console-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-datetime-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-debug-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-errorhandling-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-file-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-file-l1-2-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-file-l2-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-handle-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-heap-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-interlocked-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-libraryloader-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-localization-l1-2-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-memory-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-namedpipe-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-processenvironment-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-1.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-profile-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-rtlsupport-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-string-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-2-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-sysinfo-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-timezone-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-core-util-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-conio-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-convert-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-environment-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-filesystem-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-heap-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-locale-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-math-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-multibyte-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-private-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-process-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-runtime-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-stdio-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-string-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-time-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/api-ms-win-crt-utility-l1-1-0.dll': The system cannot find the file specified.
Could not open 'c:\Program Files\Splunk\bin/ucrtbase.dll': The system cannot find the file specified.
Those messages are not seen after doing a fresh installation of Splunk Enterprise 9.4.0
c:\Program Files\Splunk\bin>splunk.exe validate files
Validating installed files against hashes from 'c:\Program Files\Splunk\splunk-9.4.0-6b4ebe426ca6-windows-x64-manifest'
All installed files intact.
-Research of Splunk documentation and community answers was done.
-This command was run for manually performing the integrity check in Windows environment:
-It was checked Splunk functionality in upgrade and fresh installed Splunk instances
1- Taking into account that the Splunk functionality is working as expected on the new installation of Splunk Enterprise 9.4.0
and the results of running the “splunk.exe validate files” command show All installed files intact. It's possible to conclude there is no
issue with the new installation.
2- As per the error messages displayed when running the “splunk.exe validate files” command after upgrading to
Splunk Enterprise versions 9.3.x and 9.4.x, as long as the Splunk functionality is not affected it is possible to dismiss
the error and it will not appear again. Also, exists the option of disabling those integrity checks by setting theinstalled_files_integrity attribute to installed_files_integrity = disabled, under the [system_checks] stanza in the limits.conf file
3- In case that the Splunk functionality got compromised after doing an upgrade and those files are reported missing,
and there is a Splunk installation of the same software version and the same files are found present, it is possible to copy
those files to the Splunk installation that is experiencing the issue.
System checks from limits.conf
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |