All Apps and Add-ons

SA-Eventgen creates events in future

DieterS
Engager

We're using version 6.3.3 of SA-Eventgen for generating events in Splunk. For that, we've created several CSV files which contains the data.
They contain data for approx. 10 Minutes. The "end" option within the eventgen.conf file is set to 2, so data for around 20 minutes are to be created.

After Splunk restarts, events are created successfully. But after taking a deeper look at the events, it seems, that events were created in the future. Eventgen finishes its work after 1 minute and during this period the whole data is generated (the whole 20 minutes).
Generally, this should not be a problem, but we want to run eventgen continuously in our test lab and this behavior bloats our license quickly.

How can we prevent SA-Eventgen to create events in the future?

The eventgen.conf stanza of a CSV file looks like this:

[csvfile.csv]
mode = replay
sampletype = csv
outputMode = splunkstream
end = 2

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
token.0.replacementType = replaytimestamp
token.0.replacement = %Y-%m-%d %H:%M:%S.%f

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...