Hi All, I have tried to install the splunk 6.6.1 version in VM Linux environment for a testing purpose and while extracting the splunk bundle got an error and soon after extracting the bundle, when tried to execute the ./splunk start --accept-license I am getting this error. splunk bundle : splunk-6.6.1-aeae3fe0c5af-Linux-x86_64.tgz OS version : OEL 6.5 (Oracle Enterprise Linux 64 bit) RAM : 4GB [root@lab bin]# ./splunk start --accept-license This appears to be your first time running this version of Splunk. /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory Did not find "disabled" setting of "kvstore" stanza in server bundle. Splunk> Take the sh out of IT. Checking prerequisites... /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory Checking mgmt port [8089]: /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory open /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory Checking kvstore port [8191]: /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory open /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory Creating: /opt/splunk/var/lib/splunk Creating: /opt/splunk/var/run/splunk Creating: /opt/splunk/var/run/splunk/appserver/i18n Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css Creating: /opt/splunk/var/run/splunk/upload Creating: /opt/splunk/var/spool/splunk Creating: /opt/splunk/var/spool/dirmoncache Creating: /opt/splunk/var/lib/splunk/authDb Creating: /opt/splunk/var/lib/splunk/hashDb /opt/splunk/bin/splunkd: error while loading shared libraries: libxmlsec1.so.1: cannot open shared object file: No such file or directory SSL certificate generation failed. Kindly guide me how to trouble shoot this issue, so that I can install the splunk software in test environment. ... View more

Hi All, We could see some six orphan scheduled search are being populated in the Deployment server -->messages when checked the details of the orphan search, could notice that it is assigned to user who is no longer exist in our organisation and also we could locate from which saved searches these orphan search are getting triggered from Deployment server. Path where these scheduled search are configured. /opt/splunk/etc/apps/sos/local/savedsearches.conf /opt/splunk/etc/apps/search/local/savedsearches.conf By editing this files by applying # symbol on the scheduled searches and restarting the splunk services, so by disabling this files, will it stop the message from being populated in Deployment server. ... View more