Thanks! I hit this when running curl in my shell command to post an alert to a slack channel. Doing ldd /usr/lib/x86_64-linux-gnu/libcurl.so.4 in my script and piping that to a file showed that when splunk executed the script it was adding a prefix to the location of libssl as you saw. Unsetting the LD_LIBRARY_PATH it fixed it.
... View more