All Apps and Add-ons

Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day?

phoenixdigital
Builder

Eventgen is great but there seems to be one key feature missing.

I want a particular value(token) to increase or decrease based on the time of day.

Something like this

token.5.token = \s{1}(468)\s{1}
token.5.replacementType = random
token.5.replacement = integer[100:1000]
token.5.timeMultiplier = { "0": 0.30, "1": 0.10, "2": 0.05, "3": 0.10, "4": 0.15, "5": 0.25, "6": 0.35, "7": 0.50, "8": 0.60, "9": 0.65, "10": 1, "11": 1.2, "12": 2, "13": 2, "14": 1.5, "15": 1, "16": 1, "17": 0.90, "18": 0.95, "19": 1, "20": .8, "21": .8, "22": 0.60, "23": 0.45 }

Where I added timeMultiplier which takes the random number created and multiplies it by the associated value based on the time of day.

I'm happy to try to add the code myself I just need a pointer of where it might be.

More importantly it is possible the function handling token replacement might not even have access to the timestamp of the event being generated.

Too hard?

Tags (2)
0 Karma
1 Solution

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

View solution in original post

0 Karma

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...