All Apps and Add-ons

Eventgen app is not collecting the data in real time!

changwoo
Communicator

As a result, only 21 events are indexed.
but in my internaldata.csv, there are about 19mb of data.
Also it is not indexing the data in real time. ( it is indexing the data every 11 minutes. )
plz help

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

View solution in original post

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

changwoo
Communicator

THANKS !!!!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...