Installation

Splunk Universal Forwarder 7.3.6 SunOS sparc Won't Install - libstdc++.so.6 fatal error

gjlewis
Explorer

Hi,

We have an issue installing the Universal Forwarder software on Solaris 10 SPARC servers.

splunkforwarder-7.3.6-47d8552a4d84-SunOS-sparc.tar.Z

The following error occurs directly after accepting the license agreement and entering the Splunk admin username.

ld.so.1: splunkd: fatal: libstdc++.so.6: open failed: No such file or directory

OS info: SunOS 5.10 Generic_150400-65 sun4v sparc

The libc.so version is SUNW_1.23 (as per Splunk Docs: universal forwarders on a Sun SPARC system that runs Solaris need a patch level of SUNW_1.22.7 or later of the C library (libc.so.1)).

We have tried updating our LD_LIBRARY_PATH to include the location of the “missing” library.  libstdc++.so.6 is located in /usr/sfw/lib on our servers, so we ran:

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/sfw/lib

but it didn't work.

Any help or guidance would be appreciated.

Thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

xverdb
Engager

I was able to successfully install and get the Splunk 7.3.6 forwarder to start on Solaris 10 (Generic_150400-69) by copying the missing C++ library in /usr/sfw to the /opt/splunkforwarder library folder using the following procedures:

cp /usr/sfw/lib/sparc9/libstdc++.so.6.0.3 /opt/splunkforwarder/lib
cd /opt/splunkforwarder/lib
chmod 550 libstdc++.so.6.0.3
chown splunk:splunk libstdc++.so.6.0.3
ln -s libstdc++so.6.0.3 libstdc++.so.6

I suspect this would work on Solaris 11 as well.

View solution in original post

xverdb
Engager

I was able to successfully install and get the Splunk 7.3.6 forwarder to start on Solaris 10 (Generic_150400-69) by copying the missing C++ library in /usr/sfw to the /opt/splunkforwarder library folder using the following procedures:

cp /usr/sfw/lib/sparc9/libstdc++.so.6.0.3 /opt/splunkforwarder/lib
cd /opt/splunkforwarder/lib
chmod 550 libstdc++.so.6.0.3
chown splunk:splunk libstdc++.so.6.0.3
ln -s libstdc++so.6.0.3 libstdc++.so.6

I suspect this would work on Solaris 11 as well.

gjlewis
Explorer

UPDATE - I tried installing an older version of the installation software I had - 7.3.1.1 and it installed and Splunk started successfully.  So while I haven't figured out the issue, I do at least have a working forwarder on my Solaris 10 server.

I would still be interested to know if anyone knows why the older version works and the new one doesn't? According to the download page all versions of the UF software should work on Solaris 10 up to version 7.3.6.

FURTHER UPDATE - 7.3.5 also fails on start up with the same error, however 7.3.4.2 installs and starts up fine.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...