topic Issues Starting Splunk Universal Forwarder: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so in Getting Data In

Issues Starting Splunk Universal Forwarder: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so

alucarddjin — Fri, 27 Mar 2020 20:03:18 GMT

I'm trying to install a forwarder on a NAS box but everytime I try to start it I get the error:
/opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so

I've extracted it 3 times now and I get the same issue every time. I've set the owner and group to splunk:splunk and I can see that the libpcre2-8.so is in the lib folder but everytime I run the splunk start I get asked to run the set up then I enter admin as my username then it gives me this error. Please help as it's driving me potty!!

Re: Issues Starting Splunk Universal Forwarder: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so

PavelP — Fri, 27 Mar 2020 21:31:25 GMT

There could be several possible explanations, but I'll ask from other perspective - can you disable autostart of splunk, remove you splunk folder, reboot you NAS box (this is mandatory step) and install a deb/rpm package instead of tgz archive? Just try it!

Re: Issues Starting Splunk Universal Forwarder: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so

alucarddjin — Fri, 27 Mar 2020 21:38:15 GMT

There isn't a deb/rpm package for my os (ARM). Also I've not even got Splunk started never mind know how to disable autostart haha.

Re: Issues Starting Splunk Universal Forwarder: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so

PavelP — Fri, 27 Mar 2020 22:36:43 GMT

Nevermind, you can still configure syslog to send log from your NAS box to splunk. It is even better because you can save a bunch of RAM