All Apps and Add-ons

Eventgen app is not collecting the data in real time!

changwoo
Communicator

As a result, only 21 events are indexed.
but in my internaldata.csv, there are about 19mb of data.
Also it is not indexing the data in real time. ( it is indexing the data every 11 minutes. )
plz help

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

View solution in original post

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

changwoo
Communicator

THANKS !!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...