Hi,
I have installed Splunk Enterprise 7.1.2 and SA-Eventgen 6.5.3. I have not installed an extra Python version. Splunk is using its own python 2.7 engine. I use Windows 2012 R2 server operation system. I have set the environment variables:
PYTHONPATH=C:\splunk\bin;C:\Splunk\Python-2.7\Lib;C:\Splunk\Python-2.7\Lib\site-packages;C:\Splunk\Python-2.7\Lib\site-packages\splunk;C:\Splunk\Python-2.7\Scripts SPLUNK_HOME=C:\splunk SPLUNKPATH=C:\splunk
After activating of Eventgen in Data Inputs no events are generated. I have looked into the splunkd.log file and found a huge list of the following error messages:
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Loading module 'output.awss3' from 'awss3.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Searching for plugin in file 'C:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\output\\counter.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Loading module 'output.counter' from 'counter.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Searching for plugin in file 'C:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\output\\devnull.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Loading module 'output.devnull' from 'devnull.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Searching for plugin in file 'C:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\output\\file.py'"}
07-24-2020 16:51:39.450 +0200 ERROR ExecProcessor - message from "python C:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-07-24 16:51:39 eventgen DEBUG MainProcess {'event': "Loading module 'output.file' from 'file.py'"}
Can anyone give me an idea of what I have done wrong? I have looked into a tutorial video a YouTube and have done the same settings but I still get the errors.
Best regards,
Enrico
... View more
