AfterGlow app on Windows does not work

[rayfoo]

I was trying to get AfterGlow app to work with Splunk 4.0.10 build 77146 on Windows 64-bit.

Loading the AfterGlow page on IE7, the following error is thrown (JavaScript prompt) 'Splunk encountered the following unknown module: "AfterGlow" . The view may not load properly.'

Only possible clue is from web_access.log: GET /en-US/modules/@77146/AfterGlow/AfterGlow.js returned with a 404 error.

Is there a way to fix this?

[KGK_SPLUNK]

Is this broken again for 4.3 ? I am getting the following errors after doing the config and while running a test :

Traceback (most recent call last):
  File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle    \controllers\module.py", line 54, in renderModule
    pageContent = instance.generateResults(**args)

  File "C:\Program Files\Splunk\etc\apps\afterglow\appserver\modules\AfterGlow\AfterGlow.py", line 82, in generateResults
    output.write(outStr)
IOError: [Errno 0] Error

[raffy]

The AfterGlow application had to be updated to work with Splunk 4.2.x. There is a new release as of January 5th 2012 (version 1.6.2) which works with Splunk 4.2.x!

Please DOWNLOAD THE NEW RELEASE!

Also do not read the instructions in the Splunk blog entry about how to make the application work. Read the README file that comes with the app and is places in $SPLUNK_HOME/etc/apps/afterglow/README. You basically have to change two parameters in the AfterGlow.py file (AFTERGLOWLOCATION and AFTERGLOWPARAMETERS) to make things work.

See you on http://secviz.org!

[sideview · Accepted solution]

The old 3.X afterglow app was ported a long time ago to work with 4.0, and it worked quite well. It was done through the creation of a custom module called AfterGlow that comes packaged with the app (in appserver/modules/AfterGlow/).

Unfortunately what has happened is that the mechanism of packaging custom modules with apps was not covered by any testing, and not widely used. So this mechanism broke some time ago and nobody noticed until very recently.

Although in some limited cases custom UI module classes can be hacked into an app using application.js, application.css and a sprinkle of html from the ServerSideInclude module, the AfterGlow module requires its own custom endpoint in AfterGlow.py so that wouldnt work.

In a nutshell we will really have to just fix the underlying mechanism in a maintenance release.