Splunk Enterprise Security
Highlighted

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

Splunk Employee
Splunk Employee

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext
Highlighted

Re: Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LDLIBRARYPATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNKHOME/bin/splunk cmd splunkd print-modinput-config identitymanager | $SPLUNKHOME/bin/python $SPLUNKHOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

View solution in original post