- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Eventgen Generate Once
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I would like to ask on why does my Eventgen only Generate data Once.
It follows all the setting, but it ingest once.
Please see eventgen.conf
[juniper_sample]
disabled = false
latest = now
interval = 60
count = -1
randomizeCount = 0.2
outputMode = splunkstream
index = firewall_juniper
sourcetype = juniper:junos:firewall
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you are using sample files, the "count = -1" setting is telling Eventgen to replay all events in the sample file one time. Thus your results.
If you want more events using sample files, set the count value equal to the number of events that you want generated.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you are using sample files, the "count = -1" setting is telling Eventgen to replay all events in the sample file one time. Thus your results.
If you want more events using sample files, set the count value equal to the number of events that you want generated.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I resolve this issue , by uninstalling the Splunk and installing a lower version.
It's weird that latest version of Splunk and latest version of eventgen doesn't work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did this solve the issue for you?
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This didn't solve the issue , but it help a lot.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
