All Apps and Add-ons

Errors after installing EventGen

cboillot
Communicator

Just installed Eventgen on a fresh HF install. I then installed the MS IIS addon as well as the JBOSS one. I am getting errors like this:

03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached earliest time: 2020-03-05 16:02:15.115000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': 'Using cached latestTime: 2020-03-05 16:12:15.116000'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        INFO     MainProcess {'event': "Starting '1' generatorWorkers for sample 'iis.sample'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Worker# 0: Put 0.0 MB of events in queue for sample 'iis.sample'with et '2020-03-05 16:02:15.115000' and lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        DEBUG    MainProcess {'event': "Generating sample 'iis.sample' in app 'Splunk_TA_microsoft-iis' with count 1, et: '2020-03-05 16:02:15.115000', lt '2020-03-05 16:12:15.116000'"}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" 2020-03-05 16:12:15 eventgen        ERROR    MainProcess {'exception': 'Traceback (most recent call last):\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\eventgen_core.py", line 271, in _generator_do_work\n    item.run(output_counter=output_counter)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 167, in run\n    self.gen(count=self.count, earliest=self.start_time, latest=self.end_time, samplename=self._sample.name)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\plugins\\generator\\default.py", line 69, in gen\n    GeneratorPlugin.build_events(self, eventsDict, startTime, earliest, latest)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 39, in build_events\n    send_objects = self.replace_tokens(eventsDict, earliest, latest, ignore_tokens=ignore_tokens)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\generatorplugin.py", line 198, in replace_tokens\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 78, in replace\n    pivot_timestamp=pivot_timestamp)\n  File "D:\\Splunk\\etc\\apps\\SA-Eventgen\\lib\\splunk_eventgen\\lib\\eventgentoken.py", line 150, in _getReplacement\n    replacementTime = replacementTime.strftime(replacement)\nValueError: Invalid format string', 'event': 'Invalid format string'}
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Exception in thread Thread-8:
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" Traceback (most recent call last):
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 801, in __bootstrap_inner
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.run()
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\Python-2.7\Lib\threading.py", line 754, in run
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     self.__target(*self.__args, **self.__kwargs)
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"   File "D:\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\eventgen_core.py", line 282, in _generator_do_work
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"     raise e
03-05-2020 16:12:15.500 -0600 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py" ValueError: Invalid format string

Does anyone have any ideas on what the issue is?

Windows 2016
Splunk: 7.3.0
Eventgen: 6.5.2

0 Karma

rvany
Communicator

Have you checked the "ValueError: Invalid format string', 'event': 'Invalid format string'" (line 6) and "ValueError: Invalid format string" (line 15) messages? Maybe there's something wrong in some token.#.replacement string.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.