i want to know the number of events generated by eventgen, is it update this count somewhere in the log file?
On restart of splunkd daemon, eventgen generating the file, how can i stop the eventgen when it reaches to specific event count?
You can stop the eventgen (easiest) by "Disabling" the app under "App management".
To check how many events you have generated:
index=eventGenIndex | stats count
| metadata type=sourcetypes index=eventGenIndex
Not sure you can stop the eventgen after a specific number of events (with out writing a script) ... maybe it is a config question?
docs:
The application can be disabled by commenting the eventgen.conf file with "#".
You can stop the eventgen (easiest) by "Disabling" the app under "App management".
To check how many events you have generated:
index=eventGenIndex | stats count
| metadata type=sourcetypes index=eventGenIndex
Not sure you can stop the eventgen after a specific number of events (with out writing a script) ... maybe it is a config question?
docs:
disabling still generates event (i've tried sample tutorial2) 😞