topic Re: How can I collect to generate more sample data? in Getting Data In

How can I collect to generate more sample data?

greggz — Fri, 16 Mar 2018 16:02:20 GMT

I'm trying to perform a collect with the intention of making my data more heterogeneous. Meaning if I have data from only one host, I want to collect the same data but with a different host and some other different fields. Like _time for instance.

index=mock | eval _time = _time + 86400, cluster = "EDS" | collect index=mock host = "new_host"

So the new data comes with the same _raw and new host, but the _time field stays the same as the original, meaning I can't collect the data and tell that it belongs to the next day. The field cluster also does not get collected. Any ideas?

Re: How can I collect to generate more sample data?

tiagofbmm — Fri, 16 Mar 2018 16:12:50 GMT

Hey

I believe that your best solution is to use eventgen.

The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field.

Collect is not intended for generating "sample" data. Check eventgen

https://splunkbase.splunk.com/app/1924/

Re: How can I collect to generate more sample data?

kamlesh_vaghela — Fri, 16 Mar 2018 16:18:28 GMT

Hi @greggz,

I'm not sure cluster field directly indexed in index but I have tried to add it in _raw. Can you please try below search?

index=mock | eval _time = _time + 86400, _raw=_raw." cluster=\"EDS\"" | collect index=mock host = "new_host"

Thanks

Re: How can I collect to generate more sample data?

elliotproebstel — Fri, 16 Mar 2018 16:57:56 GMT

In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time, which is the earliest time of the search window. This is consistent with the documentation about collect.

I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause.