Monitoring Splunk

Library no loaded

footnote
Engager

The Mac distribution of splunk appears to have falsely referenced, absolute libraries.
I'm not sure if this is the correct place to post this, but was unable to find a link to report bugs, other than from within Splunk.

This happens to me with the following distributions (Mac 64bit, tar):

splunk-6.0-182037-darwin-64.tgz
splunk-6.0.1-189883-darwin-64.tgz (Current)

Starting Splunk:

$ bin/splunkd
dyld: Library not loaded: /Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib
  Referenced from: /Users/marius/tmp/splunk/bin/splunkd
  Reason: image not found
Trace/BPT trap: 5

A lot of the libraries seem to have incorrect, absolute references:

$ otool -L bin/splunkd
bin/splunkd:
/Users/eserv/wrangler/build-home/6.0.1/lib/libpcre.1.dylib (compatibility version 4.0.0, current version 4.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxml2.2.dylib (compatibility version 12.0.0, current version 12.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxslt.1.dylib (compatibility version 3.0.0, current version 3.28.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libarchive.13.dylib (compatibility version 15.0.0, current version 15.2.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libbz2.1.dylib (compatibility version 2.0.0, current version 2.3.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 52.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0)

I know I can fix this manually with install_name_tool but I am unsure if other binaries are affected as well.
Apologies if this is the wrong forum for this.

Tags (3)
1 Solution

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

View solution in original post

fabriziorizzo
Explorer

@Ayn... okay... now what?

Mac OS 10.11.3, Splunk Enterprise 6.3.2:

$ cd /Applications/splunk
$ ./bin/splunk commands
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Couldn't complete HTTP request: No error

rroberts
Splunk Employee
Splunk Employee

Same issue after upgrade to El Capitan.

0 Karma

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...