All Apps and Add-ons

Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day?

phoenixdigital
Builder

Eventgen is great but there seems to be one key feature missing.

I want a particular value(token) to increase or decrease based on the time of day.

Something like this

token.5.token = \s{1}(468)\s{1}
token.5.replacementType = random
token.5.replacement = integer[100:1000]
token.5.timeMultiplier = { "0": 0.30, "1": 0.10, "2": 0.05, "3": 0.10, "4": 0.15, "5": 0.25, "6": 0.35, "7": 0.50, "8": 0.60, "9": 0.65, "10": 1, "11": 1.2, "12": 2, "13": 2, "14": 1.5, "15": 1, "16": 1, "17": 0.90, "18": 0.95, "19": 1, "20": .8, "21": .8, "22": 0.60, "23": 0.45 }

Where I added timeMultiplier which takes the random number created and multiplies it by the associated value based on the time of day.

I'm happy to try to add the code myself I just need a pointer of where it might be.

More importantly it is possible the function handling token replacement might not even have access to the timestamp of the event being generated.

Too hard?

Tags (2)
0 Karma
1 Solution

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

View solution in original post

0 Karma

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...