Monitoring Splunk

Library no loaded

footnote
Engager

The Mac distribution of splunk appears to have falsely referenced, absolute libraries.
I'm not sure if this is the correct place to post this, but was unable to find a link to report bugs, other than from within Splunk.

This happens to me with the following distributions (Mac 64bit, tar):

splunk-6.0-182037-darwin-64.tgz
splunk-6.0.1-189883-darwin-64.tgz (Current)

Starting Splunk:

$ bin/splunkd
dyld: Library not loaded: /Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib
  Referenced from: /Users/marius/tmp/splunk/bin/splunkd
  Reason: image not found
Trace/BPT trap: 5

A lot of the libraries seem to have incorrect, absolute references:

$ otool -L bin/splunkd
bin/splunkd:
/Users/eserv/wrangler/build-home/6.0.1/lib/libpcre.1.dylib (compatibility version 4.0.0, current version 4.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxml2.2.dylib (compatibility version 12.0.0, current version 12.1.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libxslt.1.dylib (compatibility version 3.0.0, current version 3.28.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libarchive.13.dylib (compatibility version 15.0.0, current version 15.2.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libbz2.1.dylib (compatibility version 2.0.0, current version 2.3.0)
/Users/eserv/wrangler/build-home/6.0.1/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 52.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0)

I know I can fix this manually with install_name_tool but I am unsure if other binaries are affected as well.
Apologies if this is the wrong forum for this.

Tags (3)
1 Solution

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

View solution in original post

fabriziorizzo
Explorer

@Ayn... okay... now what?

Mac OS 10.11.3, Splunk Enterprise 6.3.2:

$ cd /Applications/splunk
$ ./bin/splunk commands
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
Referenced from: /Applications/Splunk/bin/splunkd
Reason: image not found
Couldn't complete HTTP request: No error

rroberts
Splunk Employee
Splunk Employee

Same issue after upgrade to El Capitan.

0 Karma

Ayn
Legend

You shouldn't be running splunkd directly. You should be running the splunk binary, which in turn takes care of setting up the correct environment etc before launching various instances of splunk with various parameters.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...