topic Re: Eventgen basic configuration, but still not generating any events in All Apps and Add-ons

Eventgen basic configuration, but still not generating any events

inventsekar — Tue, 27 Aug 2019 12:27:45 GMT

Hi All,.
i have been following this doc:
http://splunk.github.io/eventgen/

a fresh splunk installation
splunk eventgen installed as a Splunk App.
created a sample app (testapp)
given permission as "All apps (system)"
created this file:
/opt/splunk/etc/apps/testapp/default/eventgen.conf

[sample.tutorial1]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=splunkd

outputMode = splunkstream
splunkHost = localhost
splunkUser = admin
splunkPass = changeme

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f

updated the password:
splunkUser = admin
splunkPass = changeme
a sample file is already present at
/opt/splunk/etc/apps/SA-Eventgen/samples/sample.tutorial1
restarted the splunk. No events.
copied this above file to testapp
cp /opt/splunk/etc/apps/SA-Eventgen/samples/sample.tutorial1 /opt/splunk/etc/apps/testapp/samples
restarted splunk. NO events.

Any help would be appreciated. thanks!

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Thu, 29 Aug 2019 15:47:15 GMT

Any updates please

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 01:45:45 GMT

First you need to enable Eventgen modular input. Settings > Data Inputs > Local Inputs > SA-Eventgen > Enable
When you are using SA-Eventgen, by default the outputMode = modinput instead of splunkstream. So you can change the conf to:
[sample.tutorial1]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=splunkd

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Fri, 30 Aug 2019 05:33:07 GMT

ya, i created this config file,.. modular input has been enabled. but no events yet.

[root@ip-address default]# pwd
/opt/splunk/etc/apps/testapp/default
[root@ip-address default]# more eventgen.conf
[sample.tutorial1]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=splunkd

outputMode = splunkstream
splunkHost = localhost
splunkUser = admin
splunkPass = changeme

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f
[root@ip-address default]#

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 05:35:32 GMT

Do not use outputMode=splunkstream. Check the conf in my answer.

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Fri, 30 Aug 2019 05:39:54 GMT

ya, i updated the config file..

[root@ip-address default]# more eventgen.conf
[sample.tutorial1]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=splunkd

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f
[root@ip-address default]# pwd
/opt/splunk/etc/apps/testapp/default
[root@ip-address default]#

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 05:58:57 GMT

I can get events after waiting for a while using the same config above. Try search index=main to check the events.

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 06:00:26 GMT

Also check your testapp has global permission.

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Fri, 30 Aug 2019 06:23:38 GMT

testapp permissions modified to global. waited for few mins.. but no events yet.
should i restart splunk?

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 06:27:21 GMT

no need to restart splunk. I cannot reproduce your issue. You can have a check of the logs.

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Wed, 30 Sep 2020 02:01:10 GMT

i see these logs on splunkd.log:

08-30-2019 05:10:36.475 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.awss3' from 'awss3.py'"}
08-30-2019 05:10:36.475 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/counter.py'"}
08-30-2019 05:10:36.478 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.counter' from 'counter.py'"}
08-30-2019 05:10:36.478 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/devnull.py'"}
08-30-2019 05:10:36.481 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.devnull' from 'devnull.py'"}
08-30-2019 05:10:36.481 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/file.py'"}
08-30-2019 05:10:36.483 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.file' from 'file.py'"}
08-30-2019 05:10:36.483 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/httpevent.py'"}
08-30-2019 05:10:36.515 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.httpevent' from 'httpevent.py'"}
08-30-2019 05:10:36.515 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/httpevent_core.py'"}
08-30-2019 05:10:36.515 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Loading module 'output.httpevent_core' from 'httpevent_core.py'"}
08-30-2019 05:10:36.515 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Eventgen/bin/modinput_eventgen.py" 2019-08-30 05:10:36 eventgen DEBUG MainProcess {'event': "Searching for plugin in file '/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/output/metric_httpevent.py'"}

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 06:40:44 GMT

This is normal debug message and splunk add ERROR level to it.

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Fri, 30 Aug 2019 06:51:10 GMT

I believe you did not read the doc carefully.
Your testapp should be a bundle that has the following structure:
- samples/sample.tutorial1
- default/eventgen.conf
- metadata/default.meta

I can not get any error logs or more detail info from you and I can not give further advice.

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Sat, 31 Aug 2019 12:06:43 GMT

The bundle structure i followed, but still no luck.

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Sat, 31 Aug 2019 12:08:48 GMT

Tried that suggestions, but still no luck.
Any other suggestion please

Re: Eventgen basic configuration, but still not generating any events

inventsekar — Sat, 31 Aug 2019 22:55:05 GMT

Searched, read, tried all options at that doc link at point number 1, but still no luck.

Please provide me step by step configuration for few examples(file output, splunkstream output, replay, any other interesting methods and you can have my 50 karma points. Thanks

Re: Eventgen basic configuration, but still not generating any events

lwu_splunk — Mon, 02 Sep 2019 00:36:56 GMT

I can schedule a short meeting with you when you are available. Send me email with your available time: lwu@splunk.com. Thanks.

Re: Eventgen basic configuration, but still not generating any events

santoshkumar3 — Sun, 06 Oct 2019 07:54:01 GMT

Guys any solution for the above issue. It would be great if it can comment the solution here. I am also facing the same issue

Re: Eventgen basic configuration, but still not generating any events

richgalloway — Sun, 06 Oct 2019 12:24:42 GMT

@santoshkumar3 This question has an accepted answer. If it doesn't address your problem then you should post a new question.

Re: Eventgen basic configuration, but still not generating any events

meghasahai — Fri, 14 Aug 2020 06:39:33 GMT

Hi,

Try placing the eventgen.conf file under the $SPLUNK_HOME\etc\apps\your_app\local and then restart the Splunk.