If you try to install Splunk Enterprise on an El Capitan system, you’re going to run into some errors when you try starting it up:
$ /Applications/Splunk/bin/splunk start dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib Referenced from: /Applications/Splunk/bin/splunkd Reason: image not found dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib Referenced from: /Applications/Splunk/bin/splunkd Reason: image not found dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib Referenced from: /Applications/Splunk/bin/splunkd Reason: image not found Did not find "disabled" setting of "kvstore" stanza in server bundle.
In order to get around this, execute the following commands:
$ sudo mkdir -p /Users/eserv/wrangler/build-home/6.2.6 $ sudo ln -s /Applications/Splunk/lib /Users/eserv/wrangler/build-home/6.2.6/lib $ sudo mkdir -p /Users/eserv/wrangler-2.0/build-home/ember/ $ sudo ln -s /Applications/Splunk/lib /Users/eserv/wrangler-2.0/build-home/ember/lib
Then execute
$ /Applications/Splunk/bin/splunk restart
and everything should work fine.