Splunk web server won't start - first invocation

tedBS — Fri, 27 Nov 2015 17:22:48 GMT

Installed Splunk Light and started it. Navigated to web page at http://<username>-local:8000.
Chrome says: "This web page is not available"

Below is the output from when I launch splunk.
Troubleshooting ideas?

/Applications/Splunk/bin/splunk start
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunk> The IT Search Engine.

Checking prerequisites...
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking mgmt port [8089]: dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
open
Checking configuration... Done.
Creating: /Applications/Splunk/var/run/splunk/appserver/i18n
Creating: /Applications/Splunk/var/run/splunk/appserver/modules/static/css
Creating: /Applications/Splunk/var/run/splunk/upload
Creating: /Applications/Splunk/var/spool/splunk
Creating: /Applications/Splunk/var/spool/dirmoncache
Creating: /Applications/Splunk/var/lib/splunk/authDb
Creating: /Applications/Splunk/var/lib/splunk/hashDb
Checking critical directories...
Done
Checking indexes...
Validated: _audit _internal _introspection _thefishbucket history main summary
Done
New certs have been generated in '/Applications/Splunk/etc/auth'.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/Applications/Splunk/splunklight-6.3.1-f3e41e4b37b2-darwin-64-manifest'
All installed files intact.
Done
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done

Re: Splunk web server won't start - first invocation

pgreer_splunk — Tue, 29 Sep 2020 08:33:07 GMT

I've had the same issue on El Capitan (on a mac). What I've done as a work around is to create the Users directories and symbolic link a lib directory to my splunk installation's lib directory. For instance, for my installation on my mac:

sudo mkdir -p /Users/eserv/wrangler-2.0/build-home/ember
sudo mkdir -p /Users/eserv/wrangler/build-home/ember
sudo ln -s ~/splunk/lib /Users/eserv/wrangler-2.0/build-home/ember/lib
sudo ln -s ~/splunk/lib /Users/eserv/wrangler/build-home/ember/lib

In my case, I did a tarball installation of Splunk 6.3.2 into my local user's home directory ~/splunk_6.3.2.inst1 then created a symbolic link to it as ~/splunk. That way I can have multiple instances installed on my machine and stop/start them whenever needed and flip between them simply by removing the ~/splunk link and re-linking to the instance that I wish to work within.

What assumed (correctly) is that the latest 6.3.2 build has hard coded references to the wrangler library paths from a Splunk build environment. Setting the environment variable DYLD_LIBRARY_PATH to ~/splunk/lib in my case had no affect. The only way I've made it around the pathing issue is to do the (bit cludgy) workaround with user directories and library links as I noted above. It looks like this is fixed within 6.4.0, and more information is found at:

https://answers.splunk.com/answers/307112/why-am-i-getting-an-installation-failure-for-splun.html

I'm not certain at the moment if a 6.3.2 patched version will be released to the public download site(s).

topic Splunk web server won't start - first invocation in Splunk Enterprise

Splunk web server won't start - first invocation

Re: Splunk web server won't start - first invocation