All Apps and Add-ons

Want to know how much Data/Events can Eventgen app generate in one second

hariboppana
New Member

Hello team,

I have a configured a Splunk application and trying to run the Eventgen to test the performance of the Splunk app. The expection is to Generate around 500MB of events in a second.

However when i tried to run the Evengen, its just generating around 2MB of Events. Can you please help me in generating a much load to test the performance of the Splunk application. Thanks

Regards,
Hari

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

I stopped using EventGen long ago , GoGen scales much better : https://github.com/coccyx/gogen

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

hariboppana
New Member

Hello Kamlesh,

Thanks for the link and i have followed the same. however i cannot able to generate 0.5G per minute.My conf file is just generating 60MB per minute.

Would appreciate any help.. Thanks

Regards,
Hari
+919741979801

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @hariboppana,

My another approach is to generate events using scripted input. (Not using EventGen)
If we create few files with huge MB size of events and will use in scripted input which read these file and just index it. This will increase the size per minute. Is it ok to you? In this case, indexer must have high resources like CPU RAM even DISK Space.

BTW
Do you have any specific format for an event?

Thanks

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

From that page: "Generating 125 GB of data takes about 4 hours." Which is about 0.52 G per minute, or 9 Meg per second. That ad hoc speed is not going to meet the test requirements.

However, the actual test requirements may or may not be able to be met using the tool, depending on what @hariboppana means by "test the performance of the Splunk app". If he is testing the ingestion speed, then the data for the test can be generated in advance rather than on the fly. In that case, the above 4 hours would generate 125G of data, which when broken into chunks and delivered simultaneously would enable such stress testing for a little over 4 minutes.

0 Karma

hariboppana
New Member

Thanks DalJeanis.

I am generating the data on the fly. Eventgen is generating just 1MB per second and the output is the file mode. I dont know whether i am making a mistake in the eventgen conf file or is it depends on the Sample file as well?

Please help me in eventgen.conf configuration file and sample data [If have any] so that i can reach a 0.5G per minute.

Thanks in advance
Hari
+919741979801

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DalJeanis
Agreed.

So in this case, as a part of performance testing, is it ok if we increase the events of sample files and also increase the number of files & minimize the interval ?? I think in this case the resource should also with high configuration. Can you please provide your inputs?

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...