We're using version 6.3.3 of SA-Eventgen for generating events in Splunk. For that, we've created several CSV files which contains the data.
They contain data for approx. 10 Minutes. The "end" option within the eventgen.conf file is set to 2, so data for around 20 minutes are to be created.
After Splunk restarts, events are created successfully. But after taking a deeper look at the events, it seems, that events were created in the future. Eventgen finishes its work after 1 minute and during this period the whole data is generated (the whole 20 minutes).
Generally, this should not be a problem, but we want to run eventgen continuously in our test lab and this behavior bloats our license quickly.
How can we prevent SA-Eventgen to create events in the future?
The eventgen.conf stanza of a CSV file looks like this:
[csvfile.csv]
mode = replay
sampletype = csv
outputMode = splunkstream
end = 2
token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
token.0.replacementType = replaytimestamp
token.0.replacement = %Y-%m-%d %H:%M:%S.%f
