I've installed the Google Maps app and now I'm getting the following error when I open it: [Splunk encountered the following unknown module: "Google Maps". The view may not load properly.]
. I've restarted Splunk several times but it still doesn't work. I've also tried different browser with no success.
I'm running Splunk 4.1.5 on Windows.
This is a bug in Splunk 4.1.4 and 4.1.5 on Windows not being able to load custom modules in some cases (affects Google Maps, AfterGlow, etc).
Fortunately there is a workaround:
Open the file $SPLUNK_HOME\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\apps.py
in a text editor and add the following:
if not len(newapps): raise Exception()
on line 42.
Before:
try:
# find new apps that have to be updated
appslist = cached.getEntities('apps/local', search='new=true')
newapps = [app for app in appslist if app not in self.apps]
except:
# localapps endpoint is not available yet
if self.loaded and not force:
return True
else:
newapps = os.listdir(apps_path)
After:
try:
# find new apps that have to be updated
appslist = cached.getEntities('apps/local', search='new=true')
newapps = [app for app in appslist if app not in self.apps]
if not len(newapps): raise Exception()
except:
# localapps endpoint is not available yet
if self.loaded and not force:
return True
else:
newapps = os.listdir(apps_path)
Be sure to add the same kind of whitespace characters as on the line above. Python is very picky about whitespaces and indentions.
After a restart you should be able to view the Google Maps module.
Please do not attempt to do this in a production environment without testing it on a test instance first. No warranties!
Hi Ziegfried!
we just installed version 4.1.7, build 95063 of Splunk in a Windows 2008 R2 64bit OS. The Google maps installed correctly but we can't see any results on the pane. The apps.py has changed from previous version of splunk so there no work around.
Thanks in advance/George
So you can see the map? What kind of searches are you running? Are there any Javascript errors?
Hi ziegfried!
I'm using Google Maps app but it never shows any result... it says: "null results with location information ( null distinct locations) in the last 60 minutes"
The search I put is: source=/var/log/remots/ns_traffic.log|rename dst as clientip |geoip clientip|geonormalize
I also saw that it generates all the required fields clientip_countrycode, clientip_latitude, etc. but not the _lat and _lng hide fileds (or I can't see them...).
Any idea?
Thanks in advance, Alex
What search are you executing? What Splunk Version are you using on which platform?
This is a bug in Splunk 4.1.4 and 4.1.5 on Windows not being able to load custom modules in some cases (affects Google Maps, AfterGlow, etc).
Fortunately there is a workaround:
Open the file $SPLUNK_HOME\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\apps.py
in a text editor and add the following:
if not len(newapps): raise Exception()
on line 42.
Before:
try:
# find new apps that have to be updated
appslist = cached.getEntities('apps/local', search='new=true')
newapps = [app for app in appslist if app not in self.apps]
except:
# localapps endpoint is not available yet
if self.loaded and not force:
return True
else:
newapps = os.listdir(apps_path)
After:
try:
# find new apps that have to be updated
appslist = cached.getEntities('apps/local', search='new=true')
newapps = [app for app in appslist if app not in self.apps]
if not len(newapps): raise Exception()
except:
# localapps endpoint is not available yet
if self.loaded and not force:
return True
else:
newapps = os.listdir(apps_path)
Be sure to add the same kind of whitespace characters as on the line above. Python is very picky about whitespaces and indentions.
After a restart you should be able to view the Google Maps module.
Please do not attempt to do this in a production environment without testing it on a test instance first. No warranties!
Thanks for the answer ziegfried. One thing that might be useful to the next person is that I had to use whitespaces instead of tabs when entering this line. When putting in the text with the automatic indentation of my editor the splunkweb service failed to start. Removing the tabs and using whitespaces worked like a charm.