https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213727#M23018 <P>Looks like eventgen can do this:</P> <P>Added backfill support to allow the event generator to start up and immediately generate a user configurable amount of time's worth of events in the past. Also supports defining a search to only backfill where there is a gap.</P> Wed, 04 Nov 2015 23:55:03 GMT simpkins1958 2015-11-04T23:55:03Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213726#M23017 <P>Is there a way to create 6 months of data in Splunk so we can test an application we are creating? I've looked at Eventgen, but don't see a way to create data starting 6 months in the past.</P> Wed, 04 Nov 2015 23:23:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213726#M23017 simpkins1958 2015-11-04T23:23:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213727#M23018 <P>Looks like eventgen can do this:</P> <P>Added backfill support to allow the event generator to start up and immediately generate a user configurable amount of time's worth of events in the past. Also supports defining a search to only backfill where there is a gap.</P> Wed, 04 Nov 2015 23:55:03 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213727#M23018 simpkins1958 2015-11-04T23:55:03Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213728#M23019 <P>Yes, that's supported, although we didn't support generating data for a specified time range because there was no way to end generation. That's been added in the latest dev build, and is documented in the spec file: <A href="https://github.com/splunk/eventgen/blob/dev/README/eventgen.conf.spec#L271">https://github.com/splunk/eventgen/blob/dev/README/eventgen.conf.spec#L271</A>. If you want to grab the latest build, grab the dev branch: <A href="https://github.com/splunk/eventgen/tree/dev">https://github.com/splunk/eventgen/tree/dev</A>.</P> Thu, 05 Nov 2015 15:25:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213728#M23019 csharp_splunk 2015-11-05T15:25:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213729#M23020 <P>When using eventgen is the indexed data counted towards the daily maximum?</P> Thu, 05 Nov 2015 15:36:27 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-there-a-way-to-create-6-months-of-historical-data-in-Splunk/m-p/213729#M23020 simpkins1958 2015-11-05T15:36:27Z