https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407639#M7036 <P>upon restarting splunk forwarder, we are encountering the error below..</P> <P>python: can't open file '/opt/splunkforwarder/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory</P> <P>what could be the reason and fix for this?</P> Wed, 23 May 2018 03:35:37 GMT teddyidc1101 2018-05-23T03:35:37Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407639#M7036 <P>upon restarting splunk forwarder, we are encountering the error below..</P> <P>python: can't open file '/opt/splunkforwarder/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory</P> <P>what could be the reason and fix for this?</P> Wed, 23 May 2018 03:35:37 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407639#M7036 teddyidc1101 2018-05-23T03:35:37Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407640#M7037 <P>did you use the <CODE>/opt/splunkforwarder/bin/splunk start</CODE> command? </P> Wed, 23 May 2018 03:52:28 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407640#M7037 MuS 2018-05-23T03:52:28Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407641#M7038 <P>yes we did but still getting the error.</P> Wed, 23 May 2018 06:13:27 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407641#M7038 teddyidc1101 2018-05-23T06:13:27Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407642#M7039 <P>Hey, try running this:</P> <P><CODE>/opt/splunkforwarder/bin/splunk validate files</CODE></P> <P>It will check your install for missing files, and give you a hint what is wrong. </P> Wed, 23 May 2018 07:38:58 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407642#M7039 xpac 2018-05-23T07:38:58Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407643#M7040 <P>I triend running the command and its saying that <BR /> Result: Validating installed files against hashes from '/opt/splunkforwarder/splunkforwarder-7.0.0-c8a78efdd40f-linux-2.6-x86_64-manifest'<BR /> All installed files intact.</P> Mon, 28 May 2018 00:29:21 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407643#M7040 teddyidc1101 2018-05-28T00:29:21Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407644#M7041 <P>Wait a second, you get this error <CODE>/opt/splunkforwarder/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory</CODE> ... but this is a universal forwarder ?! <BR /> Splunk universal forwarder does not ship Python, the only Splunk software that ships Python is the full enterprise install.</P> <P>How did you install this version of Splunk; What package did you use and what command to install it?</P> <P>cheer, MuS</P> Mon, 28 May 2018 00:40:33 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407644#M7041 MuS 2018-05-28T00:40:33Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407645#M7042 <P>By the way, here are the items we looked into to check...<STRONG>did we miss anything</STRONG>?<BR /> - Checked the logs and confirmed that the events stopped coming in at 5/21 around 12:30MN<BR /> - Check on crash logs…none found<BR /> - Checked forwarder management, the server was not a client<BR /> - Executed Splunk start forwarder instead of Splunk restart - failed<BR /> - Obtained the following logs in /opt/splunkforwarder/var/log/splunk of the server : python.log – not found for splunkforwarder, splunkd-utility.log, splunkd.log<BR /> - When we checked the actual file the restart is looking for, <STRONG>file was not found,</STRONG> as indicated in the error does not exist - <BR /> <STRONG>python: can't open file '/opt/splunkforwarder/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory</STRONG><BR /> **Does this file really exist? </P> <P>What is the best way to revive the UF.** </P> Mon, 28 May 2018 00:42:10 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407645#M7042 teddyidc1101 2018-05-28T00:42:10Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407646#M7043 <P>Did you see my comment I posted just one minute before you posted your comment?</P> Mon, 28 May 2018 01:41:16 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407646#M7043 MuS 2018-05-28T01:41:16Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407647#M7044 <P>yeah i did...did we miss any steps with the one listed above?<BR /> the client installed the UF in their servers. we dont have access on them. but upon checking via splunk search, UF version is 7.0. </P> <P>checking the UF , we dont have the Python in there but what the team did was linked python and python 2 to the /opt/splunkforwarder/bin. Is this ok?</P> <P>upon checking in server via command "whereis python" , it listed /opt/splunkforwarder/bin/python. <BR /> is this ok?</P> Mon, 28 May 2018 03:08:02 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407647#M7044 teddyidc1101 2018-05-28T03:08:02Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407648#M7045 <P>you did what??? <BR /> Please revert those changes. The universal forwarder does not need Python by default. It only needs Python if you want to run a python script using the universal forwarder.</P> <P>Still this is really weird ..... </P> Mon, 28 May 2018 04:29:59 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407648#M7045 MuS 2018-05-28T04:29:59Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407649#M7046 <P>ok thanks...the linking happend 5/10 and UF stopped in 5/21, so i am not sure if they are connected at all...if we remove the link, does it impact the start/restart of the splunk instance? will it restart successfully? is reinstalling the forwarder an option here? </P> Mon, 28 May 2018 05:14:06 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407649#M7046 teddyidc1101 2018-05-28T05:14:06Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407650#M7047 <P>Yeah, that's sounds rather strange... If I were you, I'd wipe the complete /opt/splunkforwarder directory and reinstall the forwarder from scratch. Be aware, however, that this might lead to duplicate events for some time.</P> Mon, 28 May 2018 07:35:18 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407650#M7047 xpac 2018-05-28T07:35:18Z https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407651#M7048 <P>ok thanks @xpac...i'm already considering it as i'm running out of resources to look into <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> thanks so much for sharing you expertise!</P> Mon, 28 May 2018 12:21:52 GMT https://community.splunk.com/t5/Splunk-Dev/Python-Error-in-restarting-Splunk/m-p/407651#M7048 teddyidc1101 2018-05-28T12:21:52Z