We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:
# ./splunk start
ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found
There's nothing logged other than the first_install.log which has the Splunk version and platform information: PLATFORM=SunOS-sparcv9
Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.
Using the command sudo pvs /usr/lib/libc.so.1 you should see a list of patches. e.g.
The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.