https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271547#M514 <P>please use <A href="https://github.com/splunk/eventgen">Eventgen app</A> for it. You can generate it in your local laptop/dev environment and then upload to Splunk web. Or try to stick a universal forwarder in your local laptop/dev environment to do it automatically to your web.</P> Sat, 10 Sep 2016 13:31:54 GMT koshyk 2016-09-10T13:31:54Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271542#M509 <P>I was trying to find an answer for this in other threads, but unfortunately to no avail.<BR /> I'm trying to create dummy events imitating log entries.<BR /> Say I had two real log entries, one from 9/1/2016 of type "creation" (as in alert's creation) and the other one from 9/06/2016 of type "closure". What I want to do is create 4 dummy log entries of type "ongoing" in between the two (one for each day 2,3,4 and 5th of September).<BR /> Is there a way to do this? I found the "makeresults" command, but I doubt it's the right direction as I cannot think of a way to apply it to my problem.<BR /> Any help will be greatly appreciated.</P> Fri, 09 Sep 2016 14:23:52 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271542#M509 wsadowy1 2016-09-09T14:23:52Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271543#M510 <P>What are trying to accomplish with the dummy events? Perhaps there's another route to your goal without them.</P> Fri, 09 Sep 2016 15:37:51 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271543#M510 richgalloway 2016-09-09T15:37:51Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271544#M511 <P>Have you looked into creating an eventgen.conf to create your dummy events yet?</P> Fri, 09 Sep 2016 15:50:14 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271544#M511 tlelle_splunk 2016-09-09T15:50:14Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271545#M512 <P>I need to calculate the "time to restore / actual working hours" for a ticket based on numerous conditions:</P> <OL> <LI>Business Hours - each week day may have them different. Everything that is not within business hours should fall into "off clock" time.</LI> <LI>Holidays - they should be counted entirely as "off clock".</LI> <LI>Status "Pending" or "Resolved" - whenever the ticket goes into one of those, the clock should be stopped for the duration of the status.</LI> </OL> <P>Obviously the following conditions may overlap at times, so the only way I could think of for solving this problem was to search for "Creation", "Pending Start", "Pending End" and "Restoration" log entries and then split the days between each log entry into dummy log entries of type "Ongoing". Then I could put it all into a table and create help columns like "is_business_day", "is_pending", "is_holiday", "shift_start", "shift_end", "is_before_business_hours", "is_past_business_hours" etc with values of 0 or 1 per each log entry. This way even if two or more of the above conditions overlap (say a holiday and Pending status, they will be counted as one "off clock" time for as long as they overlap. <BR /> I hope this makes sense...</P> <P>If you can think of a more straightforward solution then by all means please let me know <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Sep 2020 10:55:14 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271545#M512 wsadowy1 2020-09-29T10:55:14Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271546#M513 <P>I am using Web Splunk so I don't have access to .conf files I'm afraid <span class="lia-unicode-emoji" title=":confused_face:">😕</span> Unless there's a way of achieving the same goal through the web UI</P> Sat, 10 Sep 2016 07:39:31 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271546#M513 wsadowy1 2016-09-10T07:39:31Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271547#M514 <P>please use <A href="https://github.com/splunk/eventgen">Eventgen app</A> for it. You can generate it in your local laptop/dev environment and then upload to Splunk web. Or try to stick a universal forwarder in your local laptop/dev environment to do it automatically to your web.</P> Sat, 10 Sep 2016 13:31:54 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271547#M514 koshyk 2016-09-10T13:31:54Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271548#M515 <P>To calculate days between start and complete, you can convert creation &amp; completion dates to to epoch and then subtract. However, the events you've shared don't seem to have a time for creation/completion, so not sure how you plan to calculate "off hours" or anything related to hour of day for that matter. Given that, here's one approach to add "dummy days"</P> <PRE><CODE>your base search | eval startdate=strptime(creation, "%-m/%-d/%Y") | eval enddate=strptime(completion, "%-m/%-d/%Y") | eval workdays=mvrange(startdate, enddate, "1d") | mvexpand workdays </CODE></PRE> <P>To this, if you have a lookup of holidays, you can flag those dates as "off hours" and you can exclude weekends like this</P> <PRE><CODE>... | eval dow=strftime(workdays, "%w") | where dow&lt;6 AND dow&gt;0 </CODE></PRE> <P>Hope this gets you started. If not, please provide more sample/complete events and desired output</P> Sat, 10 Sep 2016 14:52:41 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271548#M515 sundareshr 2016-09-10T14:52:41Z https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271549#M516 <P>Thank you so much for suggesting the use of mvrange and mvexpand! I was looking to get dummy days between each log entry and with use of mvrange, mvexpand and delta functions I was able to achieve just that <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Thanks again!</P> Mon, 12 Sep 2016 10:48:22 GMT https://community.splunk.com/t5/Random/How-to-create-a-number-of-dummy-events/m-p/271549#M516 wsadowy1 2016-09-12T10:48:22Z