Splunk Enterprise

Splunk web server won't start - first invocation

tedBS
New Member

Installed Splunk Light and started it. Navigated to web page at http://<username>-local:8000.
Chrome says: "This web page is not available"

Below is the output from when I launch splunk.
Troubleshooting ideas?

/Applications/Splunk/bin/splunk start
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunk> The IT Search Engine.

Checking prerequisites...
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking mgmt port [8089]: dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
open
Checking configuration... Done.
Creating: /Applications/Splunk/var/run/splunk/appserver/i18n
Creating: /Applications/Splunk/var/run/splunk/appserver/modules/static/css
Creating: /Applications/Splunk/var/run/splunk/upload
Creating: /Applications/Splunk/var/spool/splunk
Creating: /Applications/Splunk/var/spool/dirmoncache
Creating: /Applications/Splunk/var/lib/splunk/authDb
Creating: /Applications/Splunk/var/lib/splunk/hashDb
Checking critical directories...
Done
Checking indexes...
Validated: _audit _internal _introspection _thefishbucket history main summary
Done
New certs have been generated in '/Applications/Splunk/etc/auth'.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/Applications/Splunk/splunklight-6.3.1-f3e41e4b37b2-darwin-64-manifest'
All installed files intact.
Done
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done

Tags (1)
0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

I've had the same issue on El Capitan (on a mac). What I've done as a work around is to create the Users directories and symbolic link a lib directory to my splunk installation's lib directory. For instance, for my installation on my mac:

sudo mkdir -p /Users/eserv/wrangler-2.0/build-home/ember
sudo mkdir -p /Users/eserv/wrangler/build-home/ember
sudo ln -s ~/splunk/lib /Users/eserv/wrangler-2.0/build-home/ember/lib
sudo ln -s ~/splunk/lib /Users/eserv/wrangler/build-home/ember/lib

In my case, I did a tarball installation of Splunk 6.3.2 into my local user's home directory ~/splunk_6.3.2.inst1 then created a symbolic link to it as ~/splunk. That way I can have multiple instances installed on my machine and stop/start them whenever needed and flip between them simply by removing the ~/splunk link and re-linking to the instance that I wish to work within.

What assumed (correctly) is that the latest 6.3.2 build has hard coded references to the wrangler library paths from a Splunk build environment. Setting the environment variable DYLD_LIBRARY_PATH to ~/splunk/lib in my case had no affect. The only way I've made it around the pathing issue is to do the (bit cludgy) workaround with user directories and library links as I noted above. It looks like this is fixed within 6.4.0, and more information is found at:

https://answers.splunk.com/answers/307112/why-am-i-getting-an-installation-failure-for-splun.html

I'm not certain at the moment if a 6.3.2 patched version will be released to the public download site(s).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...