Just installed SA-Eventgen and get the following error: Unable to initialize modular input "modinput_eventgen" defined inside the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)

[scaglietti]

Unable to initialize modular input "modinput_eventgen" defined inside the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)

[Khuliso]

Getting the same error for days now, someone please help

[mvohra_arcusdat]

I get this error when run on Splunk 8.0 (installed on Ubuntu 16.0.4 LTS):

Traceback (most recent call last):
  File "../etc/apps/SA-Eventgen/bin/modinput_eventgen.py", line 15, in <module>
    from splunk_eventgen import eventgen_core  # noqa isort:skip
ImportError: No module named splunk_eventgen

This is a fresh Splunk install on a sandbox and nothing else is running/installed on the Splunk instance.

[guythomasdavis]

Assuming you are on a Windows system here is what I had to do to get things working:

In the app directory for eventgen which on my system is c:\program\files\splunk\etc\apps\sa-eventgen I had to go into the bin directory and edit the modinput_eventgen.py file and comment out line 141.

---

if name == 'main':
#signal.signal(signal.SIGPIPE, handler)
worker = Eventgen()
worker.execute()

sys.exit(0)

The singal.SIGPIPE attr isn't valid on windows (assuming its fine in Linux installs)

I then had to restart Splunk and in Settings->Data Inputs enable the SA-Eventgen data input.

That's it. After that I made some dumb mistakes but it is working now. If you have any questions or other problems I've probably been through them all so would be glad to help...

On the plus side, I learned a lot about troubleshooting which I'm sure will serve me well in the future!

[paullallen1]

I'm running 7.1.1 and have exactly the same issue. So any fix would be appreciated?

[guythomasdavis]

Hey how about some help with this... pretty annoying that this isn't working, when running splunk python agains modinput py file this is the result:

splunk cmd python ..\etc\apps\SA-Eventgen\bin\modinput_eventgen.py
Traceback (most recent call last):
File "..\etc\apps\SA-Eventgen\bin\modinput_eventgen.py", line 141, in
signal.signal(signal.SIGPIPE, handler)
AttributeError: 'module' object has no attribute 'SIGPIPE'