All Apps and Add-ons

Fresh install of Splunk 8.0, SA-Eventgen as an app, Windows 10 -- get an error right away

dancostello
New Member

Hello all,

I've just installed Splunk 8.0 (the free version) on a relatively uninteresting Windows 10 machine with all current patches. Accepted all defaults except I changed the home directory to "C:\Splunk\" and I selected Python 3.0. Splunk itself works beautifully, as far as I can tell. Without changing anything at all about the configuration, I then got Eventgen 7.0.0 from the splunkbase (https://splunkbase.splunk.com/app/1924/) and installed it per the directions. Upon restarting Splunk, I immediately got this message:

Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)..

On the CLI, this:

splunk cmd python modinput_eventgen.py --scheme

produces this:

python: can't open file 'modinput_eventgen.py': [Errno 2] No such file or directory

and when I cd to the app's bin directory and run the same command, I get this:

Traceback (most recent call last):
  File "modinput_eventgen.py", line 15, in <module>
    from splunk_eventgen import eventgen_core  # noqa isort:skip
ImportError: No module named splunk_eventgen

I've tried several variations -- I've installed with Python 2.0, I tried installing Splunk 7.3.2... nothing. I get the same errors every time.

Also, presumably since my problem is more fundamental, there is no "SA-Eventgen" under "Settings > Data Inputs".

I would be very grateful for any and all guidance. Thank you!

--Dan

Tags (1)
0 Karma
1 Solution

gwang_splunk
Splunk Employee
Splunk Employee

After digging deeper, I found out this might be a bug in splunk 8.0 about python3.
And the sad news is that there is no work around for this.
I have reported an issue. I will updated as soon as I get any further update.

View solution in original post

0 Karma

gwang_splunk
Splunk Employee
Splunk Employee

After digging deeper, I found out this might be a bug in splunk 8.0 about python3.
And the sad news is that there is no work around for this.
I have reported an issue. I will updated as soon as I get any further update.

0 Karma

dancostello
New Member

Thank you, Guodong, I'm very grateful for your efforts. Can I assume, then, that my only option is to use an earlier version of Splunk and use python2?
(I should mention that I'm asking specifically because I have a deadline -- in a couple of weeks I have to deliver a product that includes demonstrations using eventgen.)

0 Karma

ivanreis
Builder

I believe on this moment, you should choose to use python2. As a previously mentioned, you can use the old eventgen version on Splunk 8. I believe it will does fit your needs to run your demo.

0 Karma

dancostello
New Member

Thank you, Ivan!

0 Karma

gwang_splunk
Splunk Employee
Splunk Employee

yes. Please use an old version of eventgen. It should work with splunk 8.0.
Do not use eventgen 7. After eventgen 7, it is only python3 supported.

0 Karma

gwang_splunk
Splunk Employee
Splunk Employee

please use an editor to open the SA-Eventgen app folder. Put an empty file under the sub directory SA-Eventgen/lib/splunk_eventgen.
The empty file name should be init.py
Do not put any content in the file.
And restart splunk to check.

Till now, the splunk_eventgen should be loaded as a module.

Please make sure to set the python.version = python3 in server.conf. Starting from Eventgen 7.0, it is python3 only release.

0 Karma

ivanreis
Builder

I am running on MacBook and I had similiar issue. I also added the python configuration required for the new Eventgen version
"Note: Please set "python.version = python3" in "server.conf" in $SPLUNK_HOME/etc/system/local in [general] stanza" and it did not work either.
I am still running Splunk 8.0 version, but I redeployed the previous SA-Eventgen version = 6.5.1, and I remove the python3 configuration from server.conf, and it is working using the old python version, but I believe this new eventgen version is running on any issues that I am not able to figure it out. I hope this can help you.

0 Karma

lwu_splunk
Splunk Employee
Splunk Employee

Any ERROR log after you set the python.verison?

0 Karma

ivanreis
Builder

10-29-2019 10:49:45.581 +1100 ERROR ModularInputs - Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)..

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...