Splunk 10: Journald input not working with debian 13 (trixie)

[Beerman]

After upgrading to Debian 13 Journald input is not working anymore with Splunk 10.x.

This error I found in the internal logs:

ERROR ExecProcessor [3095663 ExecProcessor] - message from "/opt/splunk/bin/splunkd journald-modinput '$@'" journalctl: /opt/splunk/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so)

(With Debian 12 Journald input is working. And with Splunk 9.4.x Journald input is working with Debian 13)

[danielbb]

As @livehybrid said, Debian 13 isn’t listed as a supported OS for Splunk Enterprise 10.0, so this incompatibility with newer OpenSSL versions could be the cause of the issue.

It’s recommended to raise a support request at https://splunk.com/support so Splunk can address it in a future minor release.

If this helps, some karma would be appreciated!

[livehybrid]

Hi @Beerman 

Debian 13 isnt listed as a supported OS for Splunk Enterprise at https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/plan-your-splunk-e... so it could be that there is some incompatibility here with newer versions of OpenSSL. 

Despite it not being referenced as a supported OS it might be worth raising a support request/case at https://splunk.com/support so that it could potentially be addressed for a future minor release.  

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.