All Apps and Add-ons

Eventgen app is not collecting the data in real time!

changwoo
Communicator

As a result, only 21 events are indexed.
but in my internaldata.csv, there are about 19mb of data.
Also it is not indexing the data in real time. ( it is indexing the data every 11 minutes. )
plz help

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

View solution in original post

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

changwoo
Communicator

THANKS !!!!

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...