All Apps and Add-ons

Splunk 7.3.1, Windows 10 - "AfterGlow was not able to generate a graph" Issue

sheepsquatch
New Member

Hi everyone, I'm wondering if anyone has had issues generating graphs within Splunk, using AfterGlow, using the following versions of software:
Windows 10
Splunk Enterprise 7.3.1
GraphViz 2.38
ActivePerl 5.28.1 (64-bit)
Latest AfterGlow .pl plugin from the "pixcloud.com/afterglow" location linked to from the Splunkbase AfterGlow site.

I'm getting the message "AfterGlow was not able to generate a graph. Please check the neato directory in the AfterGlow Setup."

I've verified paths, tried multiple formats for inputting the paths (double '\' vs. '\' for both paths), and tried the troubleshooting steps on the plugin description page at Splunkbase. Environment variables have been set and verified as well in case that's necessary.

When following the recommended troubleshooting steps, I get a message regarding Perl define() statements which we're told we can ignore on the Details tab of the Splunkbase AfterGlow addon page. Navigating to the location where maps should be saved, there is nothing present, explaining why no file of a .map type could be generated.

For anyone that may have insight into this, or is curious, these are my logs, and the output from running manually on the command line:

From the web_service log
++++++++++++++++++++++++
2019-09-15 09:36:21,214 ERROR [5d7e3e5505230b3dddf98] admin:2466 - editProperties - unable to load the section form definition for endpoint=apps/local/afterglow
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1054 - bypass module system fast path
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1072 - PERF - viewType=fastpath viewTime=0.113s templateTime=0.001s
2019-09-15 09:36:29,088 INFO [5d7e3e5cc1230b3b11080] view:1113 - PERF - viewType=modules viewTime=0.122s templateTime=0.161s
2019-09-15 09:37:05,994 INFO [5d7e3e8007230b376eda0] AfterGlow:73 - Windows
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:82 - neato path: "C:\Program Files (x86)\Graphviz2.38\bin"\neato
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:83 - perl path: "C:\Perl64\bin"\perl
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:107 - command_used: "C:\Perl64\bin"\perl "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:108 - Could not read map file. The previous command must have failed to run properly
2019-09-15 09:37:06,382 ERROR [5d7e3e8007230b376eda0] AfterGlow:109 - [Errno 2] No such file or directory: u'C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow\..\..\static\afterglow1568554604.10.map'
2019-09-15 09:37:16,641 INFO [5d7e3e8c01230b3b11da0] view:1113 - PERF - viewType=modules viewTime=0.216s templateTime=0.334s

Command line output. Note that if it's not done from an elevated prompt, you get "Access Denied"
++++++++++++++++++++

C:\WINDOWS\system32>echo a,b,c | "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at C:\Program Files\Splunk\etc\apps\afterglow\afterglow\afterglow.pl line 650

Thanks.

T

0 Karma

sheepsquatch
New Member

For what it's worth, the AfterGlow Version is 1.6.3, build 1.5. I've tried emailing afterglow@secviz.org which is the contact posted in the details tab, but the email bounced.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...