All Apps and Add-ons

Errors after installing EventGen

cboillot
Contributor

Just installed Eventgen on a fresh HF install. I then installed the MS IIS addon as well as the JBOSS one. I am getting errors like this:

03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached earliest time: 2020-03-05 16:02:15.115000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached latestTime: 2020-03-05 16:12:15.116000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        INFO     MainProcess {'event': "Starting '1' generatorWorkers for sample 'iis.sample'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Worker# 0: Put 0.0 MB of events in queue for sample 'iis.sample'with et '2020-03-05 16:02:15.115000' and lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Generating sample 'iis.sample' in app 'Splunk_TA_microsoft-iis' with count 1, et: '2020-03-05 16:02:15.115000', lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        ERROR    MainProcess {'exception': 'Traceback (most recent call last):\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\eventgen_core.py", line 271, in _generator_do_work\n    item.run(output_counter=output_counter)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 167, in run\n    self.gen(count=self.count, earliest=self.start_time, latest=self.end_time, samplename=self._sample.name)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\generator\\default.py", line 69, in gen\n    GeneratorPlugin.build_events(self, eventsDict, startTime, earliest, latest)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 39, in build_events\n    send_objects = self.replace_tokens(eventsDict, earliest, latest, ignore_tokens=ignore_tokens)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 198, in replace_tokens\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 78, in replace\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 150, in _getReplacement\n    replacementTime = replacementTime.strftime(replacement)\nValueError: Invalid format string', 'event': 'Invalid format string'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Exception in thread Thread-8:
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Traceback (most recent call last):
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 801, in __bootstrap_inner
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.run()
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 754, in run
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.__target(*self.__args, **self.__kwargs)
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\eventgen_core.py", line 282, in _generator_do_work
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     raise e
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" ValueError: Invalid format string

Does anyone have any ideas on what the issue is?

Windows 2016
Splunk: 7.3.0
Eventgen: 6.5.2

0 Karma

rvany
Communicator

Have you checked the "ValueError: Invalid format string', 'event': 'Invalid format string'" (line 6) and "ValueError: Invalid format string" (line 15) messages? Maybe there's something wrong in some token.#.replacement string.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...