All Apps and Add-ons

Eventgen app is not collecting the data in real time!

changwoo
Communicator

As a result, only 21 events are indexed.
but in my internaldata.csv, there are about 19mb of data.
Also it is not indexing the data in real time. ( it is indexing the data every 11 minutes. )
plz help

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

View solution in original post

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

changwoo
Communicator

THANKS !!!!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...