Splunk Enterprise Security

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

mzorzi
Splunk Employee
Splunk Employee

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext
1 Solution

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...