0

I installed Splunk Enterprise 8 splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64.rpm but due to low space, I attach new HDD 50GB and created a partition and mounted it on /opt. Then I moved all the data from OLD /opt to NEW /opt of the NEW HDD, But when I tried to restart the splunk service systemctl restart splunk I received this error message:

/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunk> CSI: Logfiles.

Checking prerequisites...
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Checking mgmt port [8089]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
open
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Checking kvstore port [8191]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
open
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
SSL certificate generation failed.

[root@logging (bin)]$ 10:23:28 > systemctl status -l  splunk
 ● splunk.service - SYSV: Splunk indexer service
    Loaded: loaded (/etc/rc.d/init.d/splunk; bad; vendor preset: disabled)
    Active: failed (Result: exit-code) since Wed 2019-11-20 10:23:28 +03; 4s ago
      Docs: man:systemd-sysv-generator(8)
   Process: 14675 ExecStop=/etc/rc.d/init.d/splunk stop (code=exited, status=0/SUCCESS)
   Process: 14954 ExecStart=/etc/rc.d/init.d/splunk start (code=exited, status=127)

 Nov 20 10:23:28 logging splunk[14954]: open
 Nov 20 10:23:28 logging splunk[14954]: Checking kvstore port [8191]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
 Nov 20 10:23:28 logging splunk[14954]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
 Nov 20 10:23:28 logging splunk[14954]: open
 Nov 20 10:23:28 logging splunk[14954]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
 Nov 20 10:23:28 logging splunk[14954]: SSL certificate generation failed.
 Nov 20 10:23:28 logging systemd[1]: splunk.service: control process exited, code=exited status=127
 Nov 20 10:23:28 logging systemd[1]: Failed to start SYSV: Splunk indexer service.
 Nov 20 10:23:28 logging systemd[1]: Unit splunk.service entered failed state.
 Nov 20 10:23:28 logging systemd[1]: splunk.service failed.

Then i install the package **"yum install /libmongoc-1.0.so.0"* and restart the splunk service but this time im receiving this message

[root@logging (bin)]$ 11:45:23 > ./splunk restart
 splunkd 16147 was not running.
 Stopping splunk helpers...
                                                            [  OK  ]
 Done.
 Stopped helpers.
 Removing stale pid file... done.
 splunkd is not running.                                    [FAILED]

 Splunk> CSI: Logfiles.

 Checking prerequisites...
         Checking mgmt port [8089]: open
         Checking conf files for problems...
         Done
         Checking default conf files for edits...
         Validating installed files against hashes from '/opt/splunk/splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64-manifest'
 Error initializing openssl -- cannot compute checksums.
         Error encountered while attempting to validate files
         Problems were found, please review your files and move customizations to local
 All preliminary checks passed.

 Starting splunk server daemon (splunkd)...
 Done
                                                            [  OK  ]

The Splunk Service is up but I can't access from a browser. When I enter the username and password in Splunk Web GUI; I get this message:

Your network connection may have been lost or Splunk may be down. Your session has expired. Log in to return to the system.

1
  • Have you tried in private browsing or incognitio mode in case it is a caching issue? – Burgi Nov 20 '19 at 16:18
0

Try to make a backup of etc and var and do a fresh install of splunk on the new drive, then put the folders there. Maybe that could solve the problem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.