Fresh install of Splunk 8.0, SA-Eventgen as an app, Windows 10 -- get an error right away

[dancostello]

Hello all,

I've just installed Splunk 8.0 (the free version) on a relatively uninteresting Windows 10 machine with all current patches. Accepted all defaults except I changed the home directory to "C:\Splunk\" and I selected Python 3.0. Splunk itself works beautifully, as far as I can tell. Without changing anything at all about the configuration, I then got Eventgen 7.0.0 from the splunkbase (https://splunkbase.splunk.com/app/1924/) and installed it per the directions. Upon restarting Splunk, I immediately got this message:

Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)..

On the CLI, this:

splunk cmd python modinput_eventgen.py --scheme

produces this:

python: can't open file 'modinput_eventgen.py': [Errno 2] No such file or directory

and when I cd to the app's bin directory and run the same command, I get this:

Traceback (most recent call last):
  File "modinput_eventgen.py", line 15, in <module>
    from splunk_eventgen import eventgen_core  # noqa isort:skip
ImportError: No module named splunk_eventgen

I've tried several variations -- I've installed with Python 2.0, I tried installing Splunk 7.3.2... nothing. I get the same errors every time.

Also, presumably since my problem is more fundamental, there is no "SA-Eventgen" under "Settings > Data Inputs".

I would be very grateful for any and all guidance. Thank you!

--Dan

[gwang_splunk · Accepted solution]

After digging deeper, I found out this might be a bug in splunk 8.0 about python3.
And the sad news is that there is no work around for this.
I have reported an issue. I will updated as soon as I get any further update.

[dancostello]

Thank you, Guodong, I'm very grateful for your efforts. Can I assume, then, that my only option is to use an earlier version of Splunk and use python2?
(I should mention that I'm asking specifically because I have a deadline -- in a couple of weeks I have to deliver a product that includes demonstrations using eventgen.)

[ivanreis]

I believe on this moment, you should choose to use python2. As a previously mentioned, you can use the old eventgen version on Splunk 8. I believe it will does fit your needs to run your demo.

[dancostello]

Thank you, Ivan!

[gwang_splunk]

yes. Please use an old version of eventgen. It should work with splunk 8.0.
Do not use eventgen 7. After eventgen 7, it is only python3 supported.

[gwang_splunk]

please use an editor to open the SA-Eventgen app folder. Put an empty file under the sub directory SA-Eventgen/lib/splunk_eventgen.
The empty file name should be init.py
Do not put any content in the file.
And restart splunk to check.

Till now, the splunk_eventgen should be loaded as a module.

Please make sure to set the python.version = python3 in server.conf. Starting from Eventgen 7.0, it is python3 only release.

[ivanreis]

I am running on MacBook and I had similiar issue. I also added the python configuration required for the new Eventgen version
"Note: Please set "python.version = python3" in "server.conf" in $SPLUNK_HOME/etc/system/local in [general] stanza" and it did not work either.
I am still running Splunk 8.0 version, but I redeployed the previous SA-Eventgen version = 6.5.1, and I remove the python3 configuration from server.conf, and it is working using the old python version, but I believe this new eventgen version is running on any issues that I am not able to figure it out. I hope this can help you.

[lwu_splunk]

Any ERROR log after you set the python.verison?

[ivanreis]

10-29-2019 10:49:45.581 +1100 ERROR ModularInputs - Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)..