topic Re: What the point of using different outputMode in EventGen ? in All Apps and Add-ons

What the point of using different outputMode in EventGen ?

rendi7936 — Mon, 06 Jan 2020 03:24:55 GMT

I use tcpout and udpout outputMode with same sample log. As expected, both get same result.
Even, i do not know how to identify which one from tcpout or udpout.

Another case, when i use httpevent outputMode, i should included httpeventServers configuration.
Because, every outputMode have MUST HAVE configuration.

I include valid token in httpeventServers. And it works.
But when i use wrong token in httpeventServers. It works, too.

My question is why EventGen have so many outputMode when we can use only one outputMode to generate eventdata and its result is same like we using another outputMode ?

Re: What the point of using different outputMode in EventGen ?

lwu_splunk — Tue, 07 Jan 2020 08:35:13 GMT

I do not think httpevent with wrong httpeventServr will work. outputMode is used to send events to different targets. For example if you are using httpvent mode, you are using HEC to send events to Splunk. UDP outputMode is useful when you want to send syslog to splunk via UDP port.

Re: What the point of using different outputMode in EventGen ?

rendi7936 — Tue, 07 Jan 2020 09:33:44 GMT

I am pretty sure about it, httpevent also work when using valid or wrong httpeventServers. I say this because i

In this case, i use 2 instance installed with Splunk Enterprise 8.0.1. 1 instance ( SPLUNK8-Eventgen ) installed with Eventgen as Splunk Apps. Another instance ( SPLUNK8 ) have enabled HEC until it shows up the HEC token.

And then, i create eventgen.conf to generate event and sent it to SPLUNK8 by using httpeventServers configuration ( valid HEC token included ).

SPLUNK8 does not receive the generated event. But, the generated event is show up in SPLUNK8-Eventgen.

Even, i use wrong HEC token. This is will happening again. That's why i ask a help in Splunk Answer.

Is it outputMode in Eventgen only work as Python Module only not as Splunk Apps ? or this is a bug ?

Re: What the point of using different outputMode in EventGen ?

lwu_splunk — Tue, 07 Jan 2020 12:10:50 GMT

Yes, outputMode only works with Python Module. This is by design since Splunk App is using the modinput outputMode.

Re: What the point of using different outputMode in EventGen ?

lwu_splunk — Tue, 07 Jan 2020 12:10:57 GMT

Yes, outputMode only works with Python Module. This is by design since Splunk App is using the modinput outputMode.