All Apps and Add-ons

Splunk 7.3.1, Windows 10 - "AfterGlow was not able to generate a graph" Issue

sheepsquatch
New Member

Hi everyone, I'm wondering if anyone has had issues generating graphs within Splunk, using AfterGlow, using the following versions of software:
Windows 10
Splunk Enterprise 7.3.1
GraphViz 2.38
ActivePerl 5.28.1 (64-bit)
Latest AfterGlow .pl plugin from the "pixcloud.com/afterglow" location linked to from the Splunkbase AfterGlow site.

I'm getting the message "AfterGlow was not able to generate a graph. Please check the neato directory in the AfterGlow Setup."

I've verified paths, tried multiple formats for inputting the paths (double '\' vs. '\' for both paths), and tried the troubleshooting steps on the plugin description page at Splunkbase. Environment variables have been set and verified as well in case that's necessary.

When following the recommended troubleshooting steps, I get a message regarding Perl define() statements which we're told we can ignore on the Details tab of the Splunkbase AfterGlow addon page. Navigating to the location where maps should be saved, there is nothing present, explaining why no file of a .map type could be generated.

For anyone that may have insight into this, or is curious, these are my logs, and the output from running manually on the command line:

From the web_service log
++++++++++++++++++++++++
2019-09-15 09:36:21,214 ERROR [5d7e3e5505230b3dddf98] admin:2466 - editProperties - unable to load the section form definition for endpoint=apps/local/afterglow
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1054 - bypass module system fast path
2019-09-15 09:36:24,993 INFO [5d7e3e58d0230b3ea0b00] view:1072 - PERF - viewType=fastpath viewTime=0.113s templateTime=0.001s
2019-09-15 09:36:29,088 INFO [5d7e3e5cc1230b3b11080] view:1113 - PERF - viewType=modules viewTime=0.122s templateTime=0.161s
2019-09-15 09:37:05,994 INFO [5d7e3e8007230b376eda0] AfterGlow:73 - Windows
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:82 - neato path: "C:\Program Files (x86)\Graphviz2.38\bin"\neato
2019-09-15 09:37:05,996 INFO [5d7e3e8007230b376eda0] AfterGlow:83 - perl path: "C:\Perl64\bin"\perl
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:107 - command_used: "C:\Perl64\bin"\perl "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
2019-09-15 09:37:06,381 ERROR [5d7e3e8007230b376eda0] AfterGlow:108 - Could not read map file. The previous command must have failed to run properly
2019-09-15 09:37:06,382 ERROR [5d7e3e8007230b376eda0] AfterGlow:109 - [Errno 2] No such file or directory: u'C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow\..\..\static\afterglow1568554604.10.map'
2019-09-15 09:37:16,641 INFO [5d7e3e8c01230b3b11da0] view:1113 - PERF - viewType=modules viewTime=0.216s templateTime=0.334s

Command line output. Note that if it's not done from an elevated prompt, you get "Access Denied"
++++++++++++++++++++

C:\WINDOWS\system32>echo a,b,c | "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\afterglow.pl -c "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"......\afterglow\sample.properties -a -e 1.2 | "C:\Program Files (x86)\Graphviz2.38\bin"\neato -Tgif -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.gif -Tcmapx -o "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow"....\static\afterglow1568554604.10.map
Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at C:\Program Files\Splunk\etc\apps\afterglow\afterglow\afterglow.pl line 650

Thanks.

T

0 Karma

sheepsquatch
New Member

For what it's worth, the AfterGlow Version is 1.6.3, build 1.5. I've tried emailing afterglow@secviz.org which is the contact posted in the details tab, but the email bounced.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...