search

splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
380 stars 179 forks source link

Introspecting scheme=modinput_eventgen: script running failed (exited with code 1) #362

Closed alikat500 closed 4 years ago

alikat500 commented 4 years ago

Describe the bug I installed Eventgen as a Splunk app by downloading Eventgen directly from splunkbase. After restarting Splunk service and logging into SplunkWeb, I noticed the following message:

"Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1).."

I see see SA-Eventgen App in SplunkWeb.

However, I do not see SA-Eventgen as an input under Settings > Data inputs.

To Reproduce Steps to reproduce the behavior:

  1. Log into Web UI
  2. Click on 'messages'
  3. I will see the error

Expected behavior per installation instruction (http://splunk.github.io/eventgen/SETUP.html#splunk-app-installation), I should see SA-Eventgen as an input under Settings > Data inputs.

Actual behavior I do not see SA-Eventgen as an input under Settings > Data inputs. Also, there is the above mentioned message after Splunk restart.

Screenshots If applicable, add screenshots to help explain your problem.

Sample files and eventgen.conf file Please attach your sample files and eventgen conf file

Do you run eventgen with SA-eventgen? No If you are using SA-Eventgen with Splunk (please complete the following information):

Following is the cont of Splunk\etc\apps directory:

03/07/2020 17:19

. 03/07/2020 17:19 .. 03/06/2020 19:58 alert_logevent 03/06/2020 19:58 alert_webhook 03/06/2020 19:57 appsbrowser 03/06/2020 22:46 destinations 03/06/2020 19:57 introspection_generator_addon 03/06/2020 19:57 launcher 03/06/2020 19:59 learned 03/06/2020 19:57 legacy 03/07/2020 17:19 SA-Eventgen 03/07/2020 13:36 sample_app 03/06/2020 19:57 search 03/06/2020 19:57 SplunkForwarder 03/06/2020 19:58 SplunkLightForwarder 03/06/2020 19:58 splunk_gdi 03/06/2020 19:58 splunk_httpinput 03/06/2020 19:59 splunk_instrumentation 03/06/2020 19:57 splunk_internal_metrics 03/06/2020 19:57 splunk_metrics_workspace 03/06/2020 19:59 splunk_monitoring_console 03/06/2020 19:58 user-prefs If you are using eventgen with pip module mode (please complete the following information): N/A

Thanks Additional context Add any other context about the problem here.

li-wu commented 4 years ago

Hi @alikat500, sorry for late reply. I cannot reproduce the issue on the following condition:

  1. OS: Windows 10;
  2. Splunk: 8.0.2.1;
  3. SA-Eventgen 6.5.2;

And I also use this bundle for test.

Could you double check it? Thanks.

alikat500 commented 4 years ago

Hi Li, No problem at all. I still see the same issue on my Windows 10 setup. I installed eventgen on Ubuntu without any issues. I will use the Ubuntu install for now to wrap up the course!

Thanks for the response!

li-wu commented 4 years ago

Thanks, @alikat500. I will close the ticket. Reopen it if you have further problems.