All Apps and Add-ons

How to stop the eventgen and how to get the number of events generated by eventgen?

chitra
Explorer

i want to know the number of events generated by eventgen, is it update this count somewhere in the log file?
On restart of splunkd daemon, eventgen generating the file, how can i stop the eventgen when it reaches to specific event count?

Tags (1)
1 Solution

lmyrefelt
Builder

You can stop the eventgen (easiest) by "Disabling" the app under "App management".

To check how many events you have generated:
index=eventGenIndex | stats count

| metadata type=sourcetypes index=eventGenIndex

Not sure you can stop the eventgen after a specific number of events (with out writing a script) ... maybe it is a config question?
docs:

https://github.com/coccyx/eventgen

https://apps.splunk.com/app/1924/#/documentation

View solution in original post

Venkat_16
Contributor

The application can be disabled by commenting the eventgen.conf file with "#".

0 Karma

lmyrefelt
Builder

You can stop the eventgen (easiest) by "Disabling" the app under "App management".

To check how many events you have generated:
index=eventGenIndex | stats count

| metadata type=sourcetypes index=eventGenIndex

Not sure you can stop the eventgen after a specific number of events (with out writing a script) ... maybe it is a config question?
docs:

https://github.com/coccyx/eventgen

https://apps.splunk.com/app/1924/#/documentation

koshyk
Super Champion

disabling still generates event (i've tried sample tutorial2) 😞

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...