This is not Splunk specific issue. You can find the answer here: https://stackoverflow.com/questions/9843178/linux-capabilities-setcap-seems-to-disable-ld-library-path Generally "LD_LIBRARY_PATH=/opt/splunk/lib" get's ignored after setcap for security reasons. Workaround is via adding Splunk libraries globally, obviously with downsides of it own $ sudo sh -c "echo \"/opt/splunk/lib\" >> /etc/ld.so.conf.d/splunk.conf"
$ sudo ldconfig
... View more