User environment's PYTHONHOME variable is preventing splunk to startup properly

[splunkIT]

I encountered a scenario where one of our hosts have customized python 2.7, and a user on that host has PYTHONHOME set in its environment whenever logged in.
It looks like PYTHONHOME set for the user has interfered with splunk's bundled python package. When the user starts splunk, it would fail to load the proper python modules (ImportError: No module named site).
By default, splunk seems to set its bundled python to use bundled libraries, and prefix & exec_prefix are set to splunk installation directory. But with PYTHONHOME set, splunk python linked the libraries from customized python location, which causes it to fail.

Is there a way to override the PYTHONHOME variable in splunk, upon startup?

[OL]

Hello, I had this situation when the Splunk tgz wasn't fully extracted. I haven't used anything of the solution above

[woodcock]

Assuming that you are on linux and are using username splunk you can try this:

Login as user splunk and do these commands:

cd
echo "export PYTHONHOME=YourValueHere" > ~/.bash_profile
chmod a+x ~/.bash_profile

You need to know what YourValueHere to use but this should cause everything that the splunk user does to obtain your hard-coded value.

[jreuter_splunk · Accepted solution]

Since you are overriding both the prefix and exec_prefix by setting PYTHONHOME, you will encounter issues importing modules. You should be able to work around this by defining PYTHONHOME as the value of $SPLUNK_HOME in $SPLUNK_HOME/etc/splunk-launch.conf. This doesn't seem to work with the variable "$SPLUNK_HOME", so you will have to add the absolute path verbatim. You may also have to add PYTHONPATH if that is in your env, but it seems to expand $SPLUNK_HOME without issue.

With PYTHONHOME set (incorrectly):

[email protected]:/tmp> echo $PYTHONHOME
/dev/null
[email protected]:/tmp> echo $PYTHONPATH

Splunk will not start with python error:

[email protected]:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
ImportError: No module named site

Add PYTHONHOME to splunk-launch.conf

[email protected]:/tmp> echo -e '\nPYTHONHOME=/tmp/splunk\n' >> ./splunk/etc/splunk-launch.conf

And you should be able to work around the environmental variable being set:

[email protected]:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
Copying '/tmp/splunk/etc/openldap/ldap.conf.default' to '/tmp/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus