Monitoring Splunk

Library no loaded

footnote
Engager

The Mac distribution of splunk appears to have falsely referenced, absolute libraries.
I'm not sure if this is the correct place to post this, but was unable to find a link to report bugs, other than from within Splunk.

This happens to me with the following distributions (Mac 64bit, tar):

splunk-6.0-182037-darwin-64.tgz
splunk-6.0.1-189883-darwin-64.tgz (Current)

Starting Splunk:

$ bin/splunkd
dyld: Library not loaded: /Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib
  Referenced from: /Users/marius/tmp/splunk/bin/splunkd
  Reason: image not found
Trace/BPT trap: 5

A lot of the libraries seem to have incorrect, absolute references:

$ otool -L bin/splunkd
bin/splunkd:
/Users/eserv/wrangler/build-home/6.0.1/lib/libpcre.1.dylib (compatibility version 4.0.0, current version 4.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxml2.2.dylib (compatibility version 12.0.0, current version 12.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxslt.1.dylib (compatibility version 3.0.0, current version 3.28.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libarchive.13.dylib (compatibility version 15.0.0, current version 15.2.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libbz2.1.dylib (compatibility version 2.0.0, current version 2.3.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 52.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0)

I know I can fix this manually with install_name_tool but I am unsure if other binaries are affected as well.
Apologies if this is the wrong forum for this.

Tags (3)
1 Solution

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

View solution in original post

fabriziorizzo
Explorer

@Ayn... okay... now what?

Mac OS 10.11.3, Splunk Enterprise 6.3.2:

$ cd /Applications/splunk
$ ./bin/splunk commands
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Couldn't complete HTTP request: No error

rroberts
Splunk Employee
Splunk Employee

Same issue after upgrade to El Capitan.

0 Karma

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...