TLDR:
You can not force it to use the updated replacement file.
Long answer:
EventGen is designed for large data volume generation. So EventGen will read the replacement file once and cache it for event token replacement. Think if when you generate every event, you read from file and replace it with a random value from the file, it will have unacceptable I/O latency.
If you think it is critical for your requirement, you can make a feature request here: https://github.com/splunk/eventgen/issues/new/choose
Thanks for your feedback.
... View more