Eventgen is giving error

rahulhoney — Wed, 30 Sep 2020 00:06:15 GMT

Traceback (most recent call last):
File "/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/generator/replay.py", line 103, in gen
current_event_timestamp = self._sample.getTSFromEvent(line["_time"])
KeyError: '_time'
2019-04-16 18:41:44 eventgen ERROR MainProcess Extracting timestamp from an event failed.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/plugins/generator/replay.py", line 103, in gen
current_event_timestamp = self._sample.getTSFromEvent(line["_time"])
KeyError: '_time'

Re: Eventgen is giving error

pruthvikrishnap — Tue, 16 Apr 2019 19:14:12 GMT

HI Rahul, We might get to the issue bu looking at the conf which you are using.
Below is a similar error, check if this helps.
https://answers.splunk.com/answers/306603/eventgen-is-there-a-known-bug-with-backfill-and-re.html

Re: Eventgen is giving error

rahulhoney — Wed, 30 Sep 2020 00:11:05 GMT

From below only sample.tutorial1 is working and other 2 are not.

/opt/splunk/etc/apps/SA-Eventgen/local/eventgen.conf
[sample.tutorial1]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=splunkd

outputMode = splunkstream
splunkHost = localhost
splunkUser = rahuld
splunkPass = ########

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f

[test]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
backfillSearch = index=main sourcetype=rahuld

outputMode = splunkstream
splunkHost = localhost
splunkUser = rahuld
splunkPass = ########

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f

[test2.raw]
index=demo
host=myHost
source=test2.raw
breaker = \r*\n\r*\n
mode = replay
sampletype=raw
splunkUser = rahuld
splunkPass = ########
timeMultiple = 600
backfill = -10m
backfillSearch = index=demo source=test2.raw
outputMode = splunkstream
token.0.token = \d{4}-\d{2}-\d{2}T\d{2}.\d{2}.\d{2}
token.0.replacementType = replaytimestamp
token.0.replacement = %Y-%m-%dT%H:%M:%S
token.1.token = @@src_ip@@
token.1.replacementType = random
token.1.replacement = ipv4

/opt/splunk/etc/apps/SA-Eventgen/samples
[sample.tutorial1]
index,host,source,sourcetype,"_raw"
"main","csharp-mbp15.local","/Applications/splunk/var/log/splunk/metrics.log",splunkd,"09-15-2012 22:22:18.226 INFO Metrics - group=mpool, max_used_interval=11259, max_used=95646, avg_rsv=251, capacity=268435456, used=0"
"main","csharp-mbp15.local","/Applications/splunk/var/log/splunk/metrics.log",splunkd,"09-15-2012 22:22:18.226 INFO Metrics - group=pipeline, name=fschangemanager, processor=fschangemanager, cpu_seconds=0.000000, executes=1, cumulative_hits=506"

[test]
index,host,source,sourcetype
"main","mypc","mysource","rahul_test"

[test2.raw]
{"timestamp":"2015-09-04T15:45:00.454143Z","src_ip":"@@src_ip@@","comment":"web click #1"}
{"timestamp":"2015-09-04T15:46:01.454143Z","src_ip":"@@src_ip@@","comment":"web click #2"}
{"timestamp":"2015-09-04T15:47:02.454143Z","src_ip":"@@src_ip@@","comment":"web click #3"}
{"timestamp":"2015-09-04T15:48:03.454143Z","src_ip":"@@src_ip@@","comment":"web click #4"}

topic Eventgen is giving error in Monitoring Splunk

Eventgen is giving error

Re: Eventgen is giving error

Re: Eventgen is giving error