Splunk Enterprise Security

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

mzorzi
Splunk Employee
Splunk Employee

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext
1 Solution

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...