All Apps and Add-ons

Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day?

phoenixdigital
Builder

Eventgen is great but there seems to be one key feature missing.

I want a particular value(token) to increase or decrease based on the time of day.

Something like this

token.5.token = \s{1}(468)\s{1}
token.5.replacementType = random
token.5.replacement = integer[100:1000]
token.5.timeMultiplier = { "0": 0.30, "1": 0.10, "2": 0.05, "3": 0.10, "4": 0.15, "5": 0.25, "6": 0.35, "7": 0.50, "8": 0.60, "9": 0.65, "10": 1, "11": 1.2, "12": 2, "13": 2, "14": 1.5, "15": 1, "16": 1, "17": 0.90, "18": 0.95, "19": 1, "20": .8, "21": .8, "22": 0.60, "23": 0.45 }

Where I added timeMultiplier which takes the random number created and multiplies it by the associated value based on the time of day.

I'm happy to try to add the code myself I just need a pointer of where it might be.

More importantly it is possible the function handling token replacement might not even have access to the timestamp of the event being generated.

Too hard?

Tags (2)
0 Karma
1 Solution

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

View solution in original post

0 Karma

phoenixdigital
Builder

OK I have modified eventgen to handle this plus another feature

I have implemented a new replacementType of randomRated there was something close to this called rated in the code but it only worked off global values.

token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }

So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier or both.

The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.

token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2

So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.

Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...