Getting Data In

Just installed SA-Eventgen and get the following error: Unable to initialize modular input "modinput_eventgen" defined inside the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)

scaglietti
New Member

Unable to initialize modular input "modinput_eventgen" defined inside the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1)

Tags (1)
0 Karma

mvohra_arcusdat
Explorer

I get this error when run on Splunk 8.0 (installed on Ubuntu 16.0.4 LTS):

Traceback (most recent call last):
  File "../etc/apps/SA-Eventgen/bin/modinput_eventgen.py", line 15, in <module>
    from splunk_eventgen import eventgen_core  # noqa isort:skip
ImportError: No module named splunk_eventgen

This is a fresh Splunk install on a sandbox and nothing else is running/installed on the Splunk instance.

0 Karma

guythomasdavis
Explorer

Assuming you are on a Windows system here is what I had to do to get things working:

In the app directory for eventgen which on my system is c:\program\files\splunk\etc\apps\sa-eventgen I had to go into the bin directory and edit the modinput_eventgen.py file and comment out line 141.


if name == 'main':
#signal.signal(signal.SIGPIPE, handler)
worker = Eventgen()
worker.execute()

sys.exit(0)

The singal.SIGPIPE attr isn't valid on windows (assuming its fine in Linux installs)

I then had to restart Splunk and in Settings->Data Inputs enable the SA-Eventgen data input.

That's it. After that I made some dumb mistakes but it is working now. If you have any questions or other problems I've probably been through them all so would be glad to help...

On the plus side, I learned a lot about troubleshooting which I'm sure will serve me well in the future!

paullallen1
New Member

I'm running 7.1.1 and have exactly the same issue. So any fix would be appreciated?

0 Karma

guythomasdavis
Explorer

Hey how about some help with this... pretty annoying that this isn't working, when running splunk python agains modinput py file this is the result:

splunk cmd python ..\etc\apps\SA-Eventgen\bin\modinput_eventgen.py
Traceback (most recent call last):
File "..\etc\apps\SA-Eventgen\bin\modinput_eventgen.py", line 141, in
signal.signal(signal.SIGPIPE, handler)
AttributeError: 'module' object has no attribute 'SIGPIPE'

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...