Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

[mzorzi]

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext

[mzorzi · Accepted solution]

These are the diffent steps to resolve this:

• Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

• Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

• Execute this command at the shell. Correct output should look like:

  $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
  linux-vdso.so.1 => (0x00007fff37dbe000)
  libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
  libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
  libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
  libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
  libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
  libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
  libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
  libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
  librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
  /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

  • Source setSplunkEnv in the shell, and then retrying the operation.

  . $SPLUNK_HOME/bin/setSplunkEnv

• Finally The correct command is

  $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin