topic Eventgen Replay mode: all same timestamp in Getting Data In

Eventgen Replay mode: all same timestamp

brandy81 — Wed, 30 Sep 2020 01:41:59 GMT

Hi, Please help me out.

I try to generate events with replay mode, but it is not working properly. All timestamp is same. Of course original sample file is time series data, which means each event has different timestamp.

[sampledata1.log]
mode = replay
outputMode = splunkstream
token.0.token = \d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}.\d{3} token.0.replacementType = timestamp
token.0.replacement = %m-%d-%Y %H:%M:%S.%f

sampledata1.log
"08-07-2019 22:00:03.595 +0900 INFO loader - Running utility: ""validatedb"""
"08-07-2019 22:00:04.496 +0900 INFO loader - Getting configuration data from: /home/splunk/etc/myinstall/splunkd.xml"
"08-07-2019 22:00:05.586 +0900 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to /home/splunk/etc/modules"
"08-07-2019 22:00:06.596 +0900 INFO loader - loading modules from /home/splunk/etc/modules"
"08-07-2019 22:00:07.597 +0900 INFO loader - Writing out composite configuration file: /home/splunk/var/run/splunk/composite.xml"
................

After restart splunk, I could see this view. Generated events have same timestamp.

What I have to do? What wrong with this?

Re: Eventgen Replay mode: all same timestamp

brandy81 — Fri, 09 Aug 2019 03:31:27 GMT

It must be extracting timestamp issue. But It's correct! 😞 Could anyone please let me know what's wrong?

Re: Eventgen Replay mode: all same timestamp

dpeukert — Fri, 09 Aug 2019 13:09:59 GMT

You are using the following line:
token.0.replacementType = timestamp
Instead you should use:
token.0.replacementType = replaytimestamp

This should fix your problem.

Tip: The replaytimestamp is based on the difference of the timestamps in your sample file. So you might want to increase the difference in your sample.

Re: Eventgen Replay mode: all same timestamp

brandy81 — Sun, 11 Aug 2019 07:51:30 GMT

Thank you for the answer. But I don't understand these combination below:
1. mode=reply / token.x.replacementType = replaytimestamp
2. mode=reply / token.x.replacementType = timestamp
3. mode=sample / token.x.replacementType = replaytimestamp
4. mode=sample / token.x.replacementType = timestamp

I tested 4 cases and got to know what' differences between them, but, I would like to get to know about each option based on cases. Could anybody please let me know about those cases?