All Apps and Add-ons

Splunk 7.3.1, Windows 10 - "AfterGlow was not able to generate a graph" Issue

sheepsquatch
New Member

Hi everyone, I'm wondering if anyone has had issues generating graphs within Splunk, using AfterGlow, using the following versions of software:
Windows 10
Splunk Enterprise 7.3.1
GraphViz 2.38
ActivePerl 5.28.1 (64-bit)
Latest AfterGlow .pl plugin from the "pixcloud.com/afterglow" location linked to from the Splunkbase AfterGlow site.

I'm getting the message "AfterGlow was not able to generate a graph. Please check the neato directory in the AfterGlow Setup."

I've verified paths, tried multiple formats for inputting the paths (double '\' vs. '\' for both paths), and tried the troubleshooting steps on the plugin description page at Splunkbase. Environment variables have been set and verified as well in case that's necessary.

When following the recommended troubleshooting steps, I get a message regarding Perl define() statements which we're told we can ignore on the Details tab of the Splunkbase AfterGlow addon page. Navigating to the location where maps should be saved, there is nothing present, explaining why no file of a .map type could be generated.

For anyone that may have insight into this, or is curious, these are my logs, and the output from running manually on the command line:

From the web_service log
++++++++++++++++++++++++
2019-09-15 09:36:21,214 ERROR [5d7e3e5505230b3dddf98] admin:2466 - editProperties - unable to load the section form definition for endpoint=apps/local/afterglow
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1054 - bypass module system fast path
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1072 - PERF - viewType=fastpath viewTime=0.113s templateTime=0.001s
2019-09-15 09:36:29,088 INFO [5d7e3e5cc1230b3b11080] view:1113 - PERF - viewType=modules viewTime=0.122s templateTime=0.161s
2019-09-15 09:37:05,994 INFO [5d7e3e8007230b376eda0] AfterGlow:73 - Windows
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:82 - neato path: "C:\Program Files (x86)\Graphviz2.38\bin"\neato
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:83 - perl path: "C:\Perl64\bin"\perl
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:107 - command_used: "C:\Perl64\bin"\perl "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:108 - Could not read map file. The previous command must have failed to run properly
2019-09-15 09:37:06,382 ERROR [5d7e3e8007230b376eda0] AfterGlow:109 - [Errno 2] No such file or directory: u'C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow\..\..\static\afterglow1568554604.10.map'
2019-09-15 09:37:16,641 INFO [5d7e3e8c01230b3b11da0] view:1113 - PERF - viewType=modules viewTime=0.216s templateTime=0.334s

Command line output. Note that if it's not done from an elevated prompt, you get "Access Denied"
++++++++++++++++++++

C:\WINDOWS\system32>echo a,b,c | "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at C:\Program Files\Splunk\etc\apps\afterglow\afterglow\afterglow.pl line 650

Thanks.

T

0 Karma

sheepsquatch
New Member

For what it's worth, the AfterGlow Version is 1.6.3, build 1.5. I've tried emailing afterglow@secviz.org which is the contact posted in the details tab, but the email bounced.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...