Unable to start Splunk UF 8.2.1 on Solaris 11.3 Sparc - ld.so.1: splunk: fatal: relocation error

[dylanmnf]

Hello,

I am trying to install and run a Splunk Univeral Forwarder v8.2.1 on a number of Solaris SPARC 11.3 servers but I am getting this error message.

$ /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes
ld.so.1: splunk: fatal: relocation error: file /opt/splunkforwarder/bin/splunk: symbol in6addr_any: referenced symbol not found
Killed

The requirements here https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/Systemrequirements state the system should have SUNW_1.22.7 or later in the libc.so.1 library, and it does.

# pvs /usr/lib/libc.so.1
libc.so.1;
SUNWpublic;
SUNW_1.23;
SUNW_1.22.7;
SUNW_1.22.6;
SUNW_1.22.5;
SUNW_1.22.4;
SUNW_1.22.3;
SUNW_1.22.2;
SUNW_1.22.1;
SUNW_1.22;
SUNW_1.21.3;
SUNW_1.21.2;
SUNW_1.21.1;
SUNW_1.21;
SUNW_1.20.4;
SUNW_1.20.1;
SUNW_1.20;
SUNW_1.19;
SUNW_1.18.1;
SUNW_1.18;
SUNW_1.17;
SUNW_1.16;
SUNW_1.15;
SUNW_1.14;
SUNW_1.13;
SUNW_1.12;
SUNW_1.11;
SUNW_1.10;
SUNW_1.9;
SUNW_1.8;
SUNW_1.7;
SUNW_1.6;
SUNW_1.5;
SUNW_1.4;
SUNW_1.3;
SUNW_1.2;
SUNW_1.1;
SUNW_0.9;
SUNW_0.8;
SUNW_0.7;
SISCD_2.3;
SYSVABI_1.3;
SUNWprivate_1.1;

Does anyone have any suggestions?

Thanks

[positivevibes]

I am having similar issues with 8.2.1 whereas 8.0.5 seems to work fine.  The 8.x system requirements show only Solaris11 8.2.1 System requirements

The last version of the 7.x agent (7.3.9) shows deprecated support for Solaris10 (x86 and SPARC) 7.3.9 system requirements 

[lopezk]

Hi, 

We are having the exact same issue on Solaris 11.3 x64. Did you find a workaround for this? 

[jomasoftmarcel]

This is a known Splunk issue: SPL-197140
Workaround:
1. Do not upgrade past Splunk 8.0.5 on Solaris 11.3
OR 2. Upgrade to Solaris 11.4