Eventgen frustrations

[npgandlove]

****update**** did a new install on windows and everything is now working with the same test files. going to blow up ubuntu server and reimage and try the install again. So I am thinking it has something to do with how the install was done.

_______________________________________________________________________________________

I am working with eventgen. I have my eventgen.conf file and some sample files. I am working with the toke and regex commands in the eventgen.conf. I can get all commands to work except mvfile. I tried several ways to create the sample file but eventgen will not read the file and kicks errors such as file doesn't exist or "0 columns". I created a file with a single line of items separated by a comma and still no go. If i create a file with a single item in it whether it be a word or number, eventgen will find it and add it to the search results. If i change it to mvfile and use :1, it will not read the same file and will kick an error. Anyone please give me some guidance on why the mvfile doesn't work. Any help would be greatly appreciated.

Search will pull results from (random, file, timestamp) commands, just not mvfile

snip from eventgen.conf

"token.4.token = nodeIP=(\w+)

token.4.replacementType = mvfile

token.4.replacement = $SPLUNK_HOME/etc/apps/SA-Eventgen/samples/nodename.sample:2"

snip from nodename.sample

host01,10.11.0.1

host02,10.12.0.2

host03,10.13.0.3

Infrastructure

ubuntu server 24.04

Splunk 9.4.3

eventgen 8.2.0

I have tried to create a file from scratch with Notepad++, notepad, excel, and directly on the linux server in the samples folder.  I have validated that file as a csv file with "goteleport" and "csvlint" sites

[npgandlove]

I have taken the file and deleted and repopulated it.  I have used a new file created in notepad++ and another file created in excel.  still no luck.  I am beyond frustrated because I know it is something simple somewhere just cannot figure out where. 

[livehybrid]

Hi @npgandlove 

The mvfile replacementType in Eventgen expects the sample file to be a valid CSV with at least two columns, and the column index in your replacement (:2) must refer to the correct column (1-based index). The error "0 columns" usually means Eventgen can't parse the file as CSV or the column index is out of range.

You mentioned that you "created a file with a single line of items separated by a comma" - perhaps try the following nodename.sample:

host01,10.11.0.1
host02,10.12.0.2
host03,10.13.0.3

Then eventgen should take column 2 (the IP) for your substitutions.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing