topic Is there an easy way to create fake data? in Getting Data In

Is there an easy way to create fake data?

sboogaar — Tue, 25 Oct 2022 13:56:46 GMT

I am making a test in python where I want to validate if an ITSI kpi works as expected.

Lets say I have an index called alerts

And I want the following data in the index, because it should trigger an alert

{"alert":"true", "time":"1666702756"}

I know there is a splunk event gen application but it feels to big to add a simple line, what is the most simple way to add an event to an index? For example is it possible to do with an api call? I tried looking around but could not find a good example, for something that feels very trivial.

Note: we can not use the splunk python sdk as we use a custom proxy/url and the python sdk does not support any custom urls. We are able to run queries with our own python script so if it is possible with a spl query that is fine to.

Re: Easy way to create fake data

ITWhisperer — Tue, 25 Oct 2022 13:09:17 GMT

Have you looked at the collect command with output_format="hec" as you might be able to use it to create JSON events in the index for you?

Re: Is there an easy way to create fake data?

johnhuang — Tue, 25 Oct 2022 15:30:59 GMT

| makeresults | eval _raw="{\"alert\":\"true\", \"time\":\"".now()."\"}"
| collect index=<index_name> source=<source_name> sourcetype=<source_type> output_format=raw