Splunk Enterprise Security

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

mzorzi
Splunk Employee
Splunk Employee

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext
1 Solution

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...