Installing Splunk on El Capitan

If you try to install Splunk Enterprise on an El Capitan system, you’re going to run into some errors when you try starting it up:

$ /Applications/Splunk/bin/splunk start
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
  Referenced from: /Applications/Splunk/bin/splunkd
  Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
  Referenced from: /Applications/Splunk/bin/splunkd
  Reason: image not found
dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
  Referenced from: /Applications/Splunk/bin/splunkd
  Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

In order to get around this, execute the following commands:

$ sudo mkdir -p /Users/eserv/wrangler/build-home/6.2.6
$ sudo ln -s /Applications/Splunk/lib /Users/eserv/wrangler/build-home/6.2.6/lib

$ sudo mkdir -p /Users/eserv/wrangler-2.0/build-home/ember/
$ sudo ln -s /Applications/Splunk/lib /Users/eserv/wrangler-2.0/build-home/ember/lib

Then execute

$ /Applications/Splunk/bin/splunk restart

and everything should work fine.

Leave a Reply

Your email address will not be published. Required fields are marked *