upgrade from 4.0.x to 4.1 in OS X 10.5.8

[splunkbox]

After upgrading from 4.0.x (I don't exactly remember the version) to 4.1 in OS X 10.5.8 I get the following log

/Applications/Splunk/bin/splunk start
Traceback (most recent call last):
  File "/Applications/splunk/lib/python2.6/site-packages/splunk/clilib/cli.py", line 18, in 
    import control_api as ca
  File "/Applications/Splunk/lib/python2.6/site-packages/splunk/clilib/control_api.py", line 26, in 
    import i18n
  File "/Applications/Splunk/lib/python2.6/site-packages/splunk/clilib/i18n.py", line 7, in 
    from babel.messages import frontend
  File "/Applications/splunk/lib/python2.6/site-packages/babel/messages/__init__.py", line 16, in 
    from babel.messages.catalog import *
  File "/Applications/splunk/lib/python2.6/site-packages/babel/messages/catalog.py", line 30, in 
    from babel.dates import format_datetime
  File "/Applications/splunk/lib/python2.6/site-packages/babel/dates.py", line 28, in 
    from babel.numbers import get_decimal_symbol
  File "/Applications/splunk/lib/python2.6/site-packages/babel/numbers.py", line 41, in 
    LC_NUMERIC = default_locale('LC_NUMERIC')
  File "/Applications/splunk/lib/python2.6/site-packages/babel/core.py", line 642, in default_locale
    return '_'.join(filter(None, parse_locale(locale)))
  File "/Applications/splunk/lib/python2.6/site-packages/babel/core.py", line 763, in parse_locale
    raise ValueError('expected only letters, got %r' % lang)
ValueError: expected only letters, got 'utf-8'

and can't start Splunk anymore.

[gkanapathy · Accepted solution]

Try setting:

export LC_CTYPE=

before

/Applications/Splunk/bin/splunk start

[splunkbox]

As per gkanapathy's workaround I added LC_CTYPE= to $SPLUNK_HOME/etc/splunk-launch.conf It should also work unset LC_CTYPE Thanks jrodman for pointing the defect info.

[jrodman · Accepted solution]

This problem existed in 4.0.x also, not sure why you didn't see it. I suspect you updated OS X, since Apple didn't use this (ridiculous) LC_CTYPE in older versions.

It's defect SPL-28896 in Splunk, and it looks like there's some process goofiness that it hasn't been addressed yet. Pinging appropriate parties.

gkanapathy's workaround is viable, though I'd instead suggest:

unset LC_CTYPE

Alternatively you can choose a generally accepted locale string, such as en_US.utf-8, eg

export LC_CTYPE=en_US.utf-8

[gkanapathy · Accepted solution]

Try setting:

export LC_CTYPE=

before

/Applications/Splunk/bin/splunk start