Splunk Enterprise Security

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

mzorzi
Splunk Employee
Splunk Employee

According to the documentation for ES Asset management here:

http://docs.splunk.com/Documentation/ES/3.2.1/User/Assetmanagement

I can "force a merge" by issuing:

$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username

This does not seem to work. Upon entering this command, I receive the following error:

Traceback (most recent call last):
File "/opt/splunk/etc/aps/SA-IdentityManagement/bin/identit8y_manager.py", line 7, in 
from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/__init__.py", line 13, in 
from splunk.clilib import bundle_paths
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/bundle_paths.py", line 6, in 
import splunk.clilib.cli_common as comm
File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 6, in 
import lxml.etree as etree
ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: __xmlStructuredErrorContext
1 Solution

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

These are the diffent steps to resolve this:

  • Confirm you don't have LD_LIBRARY_PATH or PYTHONPATH settings that will interfere with the execution of Splunk commands in the shell; you need to check this for whatever user executes this command.

  • Splunk ships with libxml2 so there is no reason that executing a command as Splunk user should result in the system attempting to access the libxml2 library in /usr/lib64.

  • Execute this command at the shell. Correct output should look like:

    $ ldd $SPLUNK_HOME/lib/python2.7/site-packages/lxml/etree.so
    linux-vdso.so.1 => (0x00007fff37dbe000)
    libxslt.so.1 => /opt/splunk/lib/libxslt.so.1 (0x00007f2b17a83000)
    libexslt.so.0 => /opt/splunk/lib/libexslt.so.0 (0x00007f2b17a69000)
    libxml2.so.2 => /opt/splunk/lib/libxml2.so.2 (0x00007f2b178ad000)
    libz.so.1 => /opt/splunk/lib/libz.so.1 (0x00007f2b17895000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f2b175ff000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2b173e2000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f2b1704e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f2b16e49000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f2b16c41000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003abee00000)

    • Source setSplunkEnv in the shell, and then retrying the operation.

    . $SPLUNK_HOME/bin/setSplunkEnv

  • Finally The correct command is

    $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...