All Apps and Add-ons

Errors after installing EventGen

cboillot
Contributor

Just installed Eventgen on a fresh HF install. I then installed the MS IIS addon as well as the JBOSS one. I am getting errors like this:

03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached earliest time: 2020-03-05 16:02:15.115000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached latestTime: 2020-03-05 16:12:15.116000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        INFO     MainProcess {'event': "Starting '1' generatorWorkers for sample 'iis.sample'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Worker# 0: Put 0.0 MB of events in queue for sample 'iis.sample'with et '2020-03-05 16:02:15.115000' and lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Generating sample 'iis.sample' in app 'Splunk_TA_microsoft-iis' with count 1, et: '2020-03-05 16:02:15.115000', lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        ERROR    MainProcess {'exception': 'Traceback (most recent call last):\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\eventgen_core.py", line 271, in _generator_do_work\n    item.run(output_counter=output_counter)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 167, in run\n    self.gen(count=self.count, earliest=self.start_time, latest=self.end_time, samplename=self._sample.name)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\generator\\default.py", line 69, in gen\n    GeneratorPlugin.build_events(self, eventsDict, startTime, earliest, latest)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 39, in build_events\n    send_objects = self.replace_tokens(eventsDict, earliest, latest, ignore_tokens=ignore_tokens)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 198, in replace_tokens\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 78, in replace\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 150, in _getReplacement\n    replacementTime = replacementTime.strftime(replacement)\nValueError: Invalid format string', 'event': 'Invalid format string'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Exception in thread Thread-8:
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Traceback (most recent call last):
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 801, in __bootstrap_inner
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.run()
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 754, in run
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.__target(*self.__args, **self.__kwargs)
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\eventgen_core.py", line 282, in _generator_do_work
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     raise e
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" ValueError: Invalid format string

Does anyone have any ideas on what the issue is?

Windows 2016
Splunk: 7.3.0
Eventgen: 6.5.2

0 Karma

rvany
Communicator

Have you checked the "ValueError: Invalid format string', 'event': 'Invalid format string'" (line 6) and "ValueError: Invalid format string" (line 15) messages? Maybe there's something wrong in some token.#.replacement string.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...