All Apps and Add-ons

SA-Eventgen creates events in future

DieterS
Engager

We're using version 6.3.3 of SA-Eventgen for generating events in Splunk. For that, we've created several CSV files which contains the data.
They contain data for approx. 10 Minutes. The "end" option within the eventgen.conf file is set to 2, so data for around 20 minutes are to be created.

After Splunk restarts, events are created successfully. But after taking a deeper look at the events, it seems, that events were created in the future. Eventgen finishes its work after 1 minute and during this period the whole data is generated (the whole 20 minutes).
Generally, this should not be a problem, but we want to run eventgen continuously in our test lab and this behavior bloats our license quickly.

How can we prevent SA-Eventgen to create events in the future?

The eventgen.conf stanza of a CSV file looks like this:

[csvfile.csv]
mode = replay
sampletype = csv
outputMode = splunkstream
end = 2

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
token.0.replacementType = replaytimestamp
token.0.replacement = %Y-%m-%d %H:%M:%S.%f

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...