Monitoring Splunk

Library no loaded

footnote
Engager

The Mac distribution of splunk appears to have falsely referenced, absolute libraries.
I'm not sure if this is the correct place to post this, but was unable to find a link to report bugs, other than from within Splunk.

This happens to me with the following distributions (Mac 64bit, tar):

splunk-6.0-182037-darwin-64.tgz
splunk-6.0.1-189883-darwin-64.tgz (Current)

Starting Splunk:

$ bin/splunkd
dyld: Library not loaded: /Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib
  Referenced from: /Users/marius/tmp/splunk/bin/splunkd
  Reason: image not found
Trace/BPT trap: 5

A lot of the libraries seem to have incorrect, absolute references:

$ otool -L bin/splunkd
bin/splunkd:
/Users/eserv/wrangler/build-home/6.0.1/lib/libpcre.1.dylib (compatibility version 4.0.0, current version 4.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxml2.2.dylib (compatibility version 12.0.0, current version 12.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxslt.1.dylib (compatibility version 3.0.0, current version 3.28.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libarchive.13.dylib (compatibility version 15.0.0, current version 15.2.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libbz2.1.dylib (compatibility version 2.0.0, current version 2.3.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 52.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0)

I know I can fix this manually with install_name_tool but I am unsure if other binaries are affected as well.
Apologies if this is the wrong forum for this.

Tags (3)
1 Solution

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

View solution in original post

fabriziorizzo
Explorer

@Ayn... okay... now what?

Mac OS 10.11.3, Splunk Enterprise 6.3.2:

$ cd /Applications/splunk
$ ./bin/splunk commands
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Couldn't complete HTTP request: No error

rroberts
Splunk Employee
Splunk Employee

Same issue after upgrade to El Capitan.

0 Karma

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...