Splunk Enterprise

Splunk web server won't start - first invocation

tedBS
New Member

Installed Splunk Light and started it. Navigated to web page at http://<username>-local:8000.
Chrome says: "This web page is not available"

Below is the output from when I launch splunk.
Troubleshooting ideas?

/Applications/Splunk/bin/splunk start
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunk> The IT Search Engine.

Checking prerequisites...
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking mgmt port [8089]: dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
open
Checking configuration... Done.
Creating: /Applications/Splunk/var/run/splunk/appserver/i18n
Creating: /Applications/Splunk/var/run/splunk/appserver/modules/static/css
Creating: /Applications/Splunk/var/run/splunk/upload
Creating: /Applications/Splunk/var/spool/splunk
Creating: /Applications/Splunk/var/spool/dirmoncache
Creating: /Applications/Splunk/var/lib/splunk/authDb
Creating: /Applications/Splunk/var/lib/splunk/hashDb
Checking critical directories...
Done
Checking indexes...
Validated: _audit _internal _introspection _thefishbucket history main summary
Done
New certs have been generated in '/Applications/Splunk/etc/auth'.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/Applications/Splunk/splunklight-6.3.1-f3e41e4b37b2-darwin-64-manifest'
All installed files intact.
Done
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done

Tags (1)
0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

I've had the same issue on El Capitan (on a mac). What I've done as a work around is to create the Users directories and symbolic link a lib directory to my splunk installation's lib directory. For instance, for my installation on my mac:

sudo mkdir -p /Users/eserv/wrangler-2.0/build-home/ember
sudo mkdir -p /Users/eserv/wrangler/build-home/ember
sudo ln -s ~/splunk/lib /Users/eserv/wrangler-2.0/build-home/ember/lib
sudo ln -s ~/splunk/lib /Users/eserv/wrangler/build-home/ember/lib

In my case, I did a tarball installation of Splunk 6.3.2 into my local user's home directory ~/splunk_6.3.2.inst1 then created a symbolic link to it as ~/splunk. That way I can have multiple instances installed on my machine and stop/start them whenever needed and flip between them simply by removing the ~/splunk link and re-linking to the instance that I wish to work within.

What assumed (correctly) is that the latest 6.3.2 build has hard coded references to the wrangler library paths from a Splunk build environment. Setting the environment variable DYLD_LIBRARY_PATH to ~/splunk/lib in my case had no affect. The only way I've made it around the pathing issue is to do the (bit cludgy) workaround with user directories and library links as I noted above. It looks like this is fixed within 6.4.0, and more information is found at:

https://answers.splunk.com/answers/307112/why-am-i-getting-an-installation-failure-for-splun.html

I'm not certain at the moment if a 6.3.2 patched version will be released to the public download site(s).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...