Error installing Splunk 9.3 on RHEL 8 server

[jmrubio]

Hello!

I am trying to upgrade to the latest version of Splunk Enterprise 9.3 on a RHEL 8 server, but I am getting this error message after accepting the license. Any one seen this error? I have checked the permissions, and they are all fine. Thanks!

Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
Python runtime state: core initialized
Traceback (most recent call last):
File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 846, in exec_module
File "<frozen importlib._bootstrap_external>", line 982, in get_code
File "<frozen importlib._bootstrap_external>", line 1039, in get_data
PermissionError: [Errno 1] Operation not permitted: '/opt/splunk/lib/python3.9/encodings/__init__.py'

[jmrubio · Accepted solution]

So this issue was being caused by an fapolicyd deny all rule. Once I moved the rule out of the /etc/fapolicyd/rules.d, it let me upgrade Splunk.

[marnall]

Could you try running it once with sudo? This should allow you to accept the license agreement, and then Splunk will use system privileges to set up the systemd service. Afterwards it should be controllable with systemctl.