Splunk Search

What are manifest files used for in Splunk home directory?

ben_leung
Builder

splunk-6.1.4-233537-darwin-64-manifest

These files only list out the directory of Splunk. When upgrading from version to version, I have accumulated old manifest files. Are they still useful to Splunk or can I just remove them?

What is the purpose for them any ways?

Tags (1)
0 Karma

bohanlon_splunk
Splunk Employee
Splunk Employee

You can just remove them. They are an anti tampering mechanism generated at install time.
However, when you change versions (e.g. during upgrades), the old one gets left behind.

If you need to regenerate them, check out this post:
https://answers.splunk.com/answers/455739/how-can-i-regenerate-my-package-manifest-file.html#answer-...

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I have some built up too. They are 833KB large for me, so I just leave them alone. I just tried moving all mine to a different location and splunk is acting normally, but I have no idea if splunk might use time in the future.

Note: These are NOT the same as a .bucketManifest that you find in locations such as $SPLUNK_HOME/var/lib/splunk/default/db

As for what they are / why they are there, here's a definition.

Wikipedia

In software packaging, it is common to list the contents of a distribution in a manifest file. This file simply enumerates the files which are included in the distribution, either for processing by various packaging tools, or for human consumption.

The term is a loan from shipping, where a ship's manifest would list the crew or cargo of a vessel.

The manifest may optionally contain a cryptographic hash or checksum of each file. By creating a cryptographic signature for such a manifest file, the entire contents of the distribution package can be validated, as altering any of the files will invalidate the checksums in the manifest file.

The manifest files usually have a .MF extension, or a .manifest extension in Windows.

0 Karma

ben_leung
Builder

So I think there is no harm in removing old versions of the manifest files from Splunk home. They would be outdated anyways, save the latest version.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...