Splunk Dev

User environment's PYTHONHOME variable is preventing splunk to startup properly

splunkIT
Splunk Employee
Splunk Employee

I encountered a scenario where one of our hosts have customized python 2.7, and a user on that host has PYTHONHOME set in its environment whenever logged in.
It looks like PYTHONHOME set for the user has interfered with splunk's bundled python package. When the user starts splunk, it would fail to load the proper python modules (ImportError: No module named site).
By default, splunk seems to set its bundled python to use bundled libraries, and prefix & exec_prefix are set to splunk installation directory. But with PYTHONHOME set, splunk python linked the libraries from customized python location, which causes it to fail.

Is there a way to override the PYTHONHOME variable in splunk, upon startup?

Tags (1)
1 Solution

jreuter_splunk
Splunk Employee
Splunk Employee

Since you are overriding both the prefix and exec_prefix by setting PYTHONHOME, you will encounter issues importing modules. You should be able to work around this by defining PYTHONHOME as the value of $SPLUNK_HOME in $SPLUNK_HOME/etc/splunk-launch.conf. This doesn't seem to work with the variable "$SPLUNK_HOME", so you will have to add the absolute path verbatim. You may also have to add PYTHONPATH if that is in your env, but it seems to expand $SPLUNK_HOME without issue.

With PYTHONHOME set (incorrectly):

notroot@localhost.localdomain:/tmp> echo $PYTHONHOME
/dev/null
notroot@localhost.localdomain:/tmp> echo $PYTHONPATH

Splunk will not start with python error:

notroot@localhost.localdomain:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
ImportError: No module named site

Add PYTHONHOME to splunk-launch.conf

notroot@localhost.localdomain:/tmp> echo -e '\nPYTHONHOME=/tmp/splunk\n' >> ./splunk/etc/splunk-launch.conf

And you should be able to work around the environmental variable being set:

notroot@localhost.localdomain:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
Copying '/tmp/splunk/etc/openldap/ldap.conf.default' to '/tmp/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus

View solution in original post

OL
Communicator

Hello, I had this situation when the Splunk tgz wasn't fully extracted. I haven't used anything of the solution above

0 Karma

woodcock
Esteemed Legend

Assuming that you are on linux and are using username splunk you can try this:

Login as user splunk and do these commands:

cd
echo "export PYTHONHOME=YourValueHere" > ~/.bash_profile
chmod a+x ~/.bash_profile

You need to know what YourValueHere to use but this should cause everything that the splunk user does to obtain your hard-coded value.

0 Karma

jreuter_splunk
Splunk Employee
Splunk Employee

Since you are overriding both the prefix and exec_prefix by setting PYTHONHOME, you will encounter issues importing modules. You should be able to work around this by defining PYTHONHOME as the value of $SPLUNK_HOME in $SPLUNK_HOME/etc/splunk-launch.conf. This doesn't seem to work with the variable "$SPLUNK_HOME", so you will have to add the absolute path verbatim. You may also have to add PYTHONPATH if that is in your env, but it seems to expand $SPLUNK_HOME without issue.

With PYTHONHOME set (incorrectly):

notroot@localhost.localdomain:/tmp> echo $PYTHONHOME
/dev/null
notroot@localhost.localdomain:/tmp> echo $PYTHONPATH

Splunk will not start with python error:

notroot@localhost.localdomain:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
ImportError: No module named site

Add PYTHONHOME to splunk-launch.conf

notroot@localhost.localdomain:/tmp> echo -e '\nPYTHONHOME=/tmp/splunk\n' >> ./splunk/etc/splunk-launch.conf

And you should be able to work around the environmental variable being set:

notroot@localhost.localdomain:/tmp> ./splunk/bin/splunk start --accept-license
This appears to be your first time running this version of Splunk.
Copying '/tmp/splunk/etc/openldap/ldap.conf.default' to '/tmp/splunk/etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...