All Apps and Add-ons

Errors after installing EventGen

cboillot
Contributor

Just installed Eventgen on a fresh HF install. I then installed the MS IIS addon as well as the JBOSS one. I am getting errors like this:

03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached earliest time: 2020-03-05 16:02:15.115000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached latestTime: 2020-03-05 16:12:15.116000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        INFO     MainProcess {'event': "Starting '1' generatorWorkers for sample 'iis.sample'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Worker# 0: Put 0.0 MB of events in queue for sample 'iis.sample'with et '2020-03-05 16:02:15.115000' and lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Generating sample 'iis.sample' in app 'Splunk_TA_microsoft-iis' with count 1, et: '2020-03-05 16:02:15.115000', lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        ERROR    MainProcess {'exception': 'Traceback (most recent call last):\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\eventgen_core.py", line 271, in _generator_do_work\n    item.run(output_counter=output_counter)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 167, in run\n    self.gen(count=self.count, earliest=self.start_time, latest=self.end_time, samplename=self._sample.name)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\generator\\default.py", line 69, in gen\n    GeneratorPlugin.build_events(self, eventsDict, startTime, earliest, latest)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 39, in build_events\n    send_objects = self.replace_tokens(eventsDict, earliest, latest, ignore_tokens=ignore_tokens)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 198, in replace_tokens\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 78, in replace\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 150, in _getReplacement\n    replacementTime = replacementTime.strftime(replacement)\nValueError: Invalid format string', 'event': 'Invalid format string'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Exception in thread Thread-8:
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Traceback (most recent call last):
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 801, in __bootstrap_inner
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.run()
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 754, in run
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.__target(*self.__args, **self.__kwargs)
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\eventgen_core.py", line 282, in _generator_do_work
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     raise e
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" ValueError: Invalid format string

Does anyone have any ideas on what the issue is?

Windows 2016
Splunk: 7.3.0
Eventgen: 6.5.2

0 Karma

rvany
Communicator

Have you checked the "ValueError: Invalid format string', 'event': 'Invalid format string'" (line 6) and "ValueError: Invalid format string" (line 15) messages? Maybe there's something wrong in some token.#.replacement string.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...