I installed Splunk Enterprise 8 splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64.rpm but due to low space, I attach new HDD 50GB and created a partition and mounted it on /opt. Then I moved all the data from OLD /opt to NEW /opt of the NEW HDD, But when I tried to restart the splunk service systemctl restart splunk I received this error message:
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Did not find "disabled" setting of "kvstore" stanza in server bundle.
Splunk> CSI: Logfiles.
Checking prerequisites...
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Checking mgmt port [8089]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
open
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Checking kvstore port [8191]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
open
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
/opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
SSL certificate generation failed.
[root@logging (bin)]$ 10:23:28 > systemctl status -l splunk
● splunk.service - SYSV: Splunk indexer service
Loaded: loaded (/etc/rc.d/init.d/splunk; bad; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2019-11-20 10:23:28 +03; 4s ago
Docs: man:systemd-sysv-generator(8)
Process: 14675 ExecStop=/etc/rc.d/init.d/splunk stop (code=exited, status=0/SUCCESS)
Process: 14954 ExecStart=/etc/rc.d/init.d/splunk start (code=exited, status=127)
Nov 20 10:23:28 logging splunk[14954]: open
Nov 20 10:23:28 logging splunk[14954]: Checking kvstore port [8191]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Nov 20 10:23:28 logging splunk[14954]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Nov 20 10:23:28 logging splunk[14954]: open
Nov 20 10:23:28 logging splunk[14954]: /opt/splunk/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory
Nov 20 10:23:28 logging splunk[14954]: SSL certificate generation failed.
Nov 20 10:23:28 logging systemd[1]: splunk.service: control process exited, code=exited status=127
Nov 20 10:23:28 logging systemd[1]: Failed to start SYSV: Splunk indexer service.
Nov 20 10:23:28 logging systemd[1]: Unit splunk.service entered failed state.
Nov 20 10:23:28 logging systemd[1]: splunk.service failed.
Then i install the package **"yum install /libmongoc-1.0.so.0"* and restart the splunk service but this time im receiving this message
[root@logging (bin)]$ 11:45:23 > ./splunk restart
splunkd 16147 was not running.
Stopping splunk helpers...
[ OK ]
Done.
Stopped helpers.
Removing stale pid file... done.
splunkd is not running. [FAILED]
Splunk> CSI: Logfiles.
Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64-manifest'
Error initializing openssl -- cannot compute checksums.
Error encountered while attempting to validate files
Problems were found, please review your files and move customizations to local
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done
[ OK ]
The Splunk Service is up but I can't access from a browser. When I enter the username and password in Splunk Web GUI; I get this message:
Your network connection may have been lost or Splunk may be down. Your session has expired. Log in to return to the system.
