<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day? in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Eventgen-How-to-get-a-particular-value-token-to-increase-or/m-p/156510#M14293</link>
    <description>&lt;P&gt;Eventgen is great but there seems to be one key feature missing.&lt;/P&gt;

&lt;P&gt;I want a particular value(token) to increase or decrease based on the time of day.&lt;/P&gt;

&lt;P&gt;Something like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;token.5.token = \s{1}(468)\s{1}
token.5.replacementType = random
token.5.replacement = integer[100:1000]
token.5.timeMultiplier = { "0": 0.30, "1": 0.10, "2": 0.05, "3": 0.10, "4": 0.15, "5": 0.25, "6": 0.35, "7": 0.50, "8": 0.60, "9": 0.65, "10": 1, "11": 1.2, "12": 2, "13": 2, "14": 1.5, "15": 1, "16": 1, "17": 0.90, "18": 0.95, "19": 1, "20": .8, "21": .8, "22": 0.60, "23": 0.45 }
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where I added timeMultiplier which takes the random number created and multiplies it by the associated value based on the time of day.&lt;/P&gt;

&lt;P&gt;I'm happy to try to add the code myself I just need a pointer of where it might be.&lt;/P&gt;

&lt;P&gt;More importantly it is possible the function handling token replacement might not even have access to the timestamp of the event being generated. &lt;/P&gt;

&lt;P&gt;Too hard?&lt;/P&gt;</description>
    <pubDate>Thu, 06 Aug 2015 23:40:52 GMT</pubDate>
    <dc:creator>phoenixdigital</dc:creator>
    <dc:date>2015-08-06T23:40:52Z</dc:date>
    <item>
      <title>Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Eventgen-How-to-get-a-particular-value-token-to-increase-or/m-p/156510#M14293</link>
      <description>&lt;P&gt;Eventgen is great but there seems to be one key feature missing.&lt;/P&gt;

&lt;P&gt;I want a particular value(token) to increase or decrease based on the time of day.&lt;/P&gt;

&lt;P&gt;Something like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;token.5.token = \s{1}(468)\s{1}
token.5.replacementType = random
token.5.replacement = integer[100:1000]
token.5.timeMultiplier = { "0": 0.30, "1": 0.10, "2": 0.05, "3": 0.10, "4": 0.15, "5": 0.25, "6": 0.35, "7": 0.50, "8": 0.60, "9": 0.65, "10": 1, "11": 1.2, "12": 2, "13": 2, "14": 1.5, "15": 1, "16": 1, "17": 0.90, "18": 0.95, "19": 1, "20": .8, "21": .8, "22": 0.60, "23": 0.45 }
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where I added timeMultiplier which takes the random number created and multiplies it by the associated value based on the time of day.&lt;/P&gt;

&lt;P&gt;I'm happy to try to add the code myself I just need a pointer of where it might be.&lt;/P&gt;

&lt;P&gt;More importantly it is possible the function handling token replacement might not even have access to the timestamp of the event being generated. &lt;/P&gt;

&lt;P&gt;Too hard?&lt;/P&gt;</description>
      <pubDate>Thu, 06 Aug 2015 23:40:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Eventgen-How-to-get-a-particular-value-token-to-increase-or/m-p/156510#M14293</guid>
      <dc:creator>phoenixdigital</dc:creator>
      <dc:date>2015-08-06T23:40:52Z</dc:date>
    </item>
    <item>
      <title>Re: Eventgen: How to get a particular value (token) to increase or decrease by a random number based on the time of day?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Eventgen-How-to-get-a-particular-value-token-to-increase-or/m-p/156511#M14294</link>
      <description>&lt;P&gt;OK I have modified eventgen to handle this plus another feature&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;lib/eventgenconfig.py - &lt;A href="http://pastebin.com/pwKXe0mL"&gt;http://pastebin.com/pwKXe0mL&lt;/A&gt;&lt;/LI&gt;
&lt;LI&gt;lib/eventgensamples.py - &lt;A href="http://pastebin.com/dNnX3vNB"&gt;http://pastebin.com/dNnX3vNB&lt;/A&gt;&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;I have implemented a new replacementType of &lt;STRONG&gt;randomRated&lt;/STRONG&gt; there was something close to this called &lt;STRONG&gt;rated&lt;/STRONG&gt; in the code but it only worked off global values.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;token.1.token = @@fastdaytime
token.1.replacementType = randomRated
token.1.replacement = integer[1000:1100]
token.1.hourOfDayMultiplier = { "0": 0.2, "1": 0.3, "2": 0.4, "3": 0.5, "4": 0.5, "5": 0.5, "6": 0.5, "7": 0.5, "8": 1, "9": 1.5, "10": 4, "11": 5, "12": 6, "13": 6, "14": 5, "15": 2, "16": 1.5, "17": 1, "18": 0.8, "19": 0.7, "20": 0.5, "21": 0.5, "22": 0.5, "23": 0.5 }
token.1.dayOfWeekMultiplier = { "0": 1, "1": 1, "2": 1, "3": 1, "4": 1, "5": 1, "6": 1 }
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So what will happen is if you have an integer or float random generated value you can also apply a multiplier to the resulting random number based on the time of day and/or day of the week. You can configure hourOfDayMultiplier or dayOfWeekMultiplier  or both.&lt;/P&gt;

&lt;P&gt;The other feature I added was the ability to gradually increase the size of a field by a certain amount +- a random number. This generates a gradual increase in value with some slight randomness to it.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;token.3.token = @@NT
token.3.replacementType = integerid
token.3.replacement = 101
token.3.replacementIncrementAmount = 20
token.3.replacementIncrementAmountRandomness = 0.2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So in the instance above the value will start at 101 then increase by 18 - 22 each subsequent event. 10% variation either side of 20.&lt;/P&gt;

&lt;P&gt;Does anyone know who I can submit the changes to? I made sure I did not impact on any existing code so it should be backwards compatible&lt;/P&gt;</description>
      <pubDate>Mon, 10 Aug 2015 02:54:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Eventgen-How-to-get-a-particular-value-token-to-increase-or/m-p/156511#M14294</guid>
      <dc:creator>phoenixdigital</dc:creator>
      <dc:date>2015-08-10T02:54:29Z</dc:date>
    </item>
  </channel>
</rss>

