All Apps and Add-ons

What the point of using different outputMode in EventGen ?

rendi7936
New Member

I use tcpout and udpout outputMode with same sample log. As expected, both get same result.
Even, i do not know how to identify which one from tcpout or udpout.

Another case, when i use httpevent outputMode, i should included httpeventServers configuration.
Because, every outputMode have MUST HAVE configuration.

I include valid token in httpeventServers. And it works.
But when i use wrong token in httpeventServers. It works, too.

My question is why EventGen have so many outputMode when we can use only one outputMode to generate eventdata and its result is same like we using another outputMode ?

Tags (2)
0 Karma
1 Solution

lwu_splunk
Splunk Employee
Splunk Employee

I do not think httpevent with wrong httpeventServr will work. outputMode is used to send events to different targets. For example if you are using httpvent mode, you are using HEC to send events to Splunk. UDP outputMode is useful when you want to send syslog to splunk via UDP port.

View solution in original post

0 Karma

lwu_splunk
Splunk Employee
Splunk Employee

I do not think httpevent with wrong httpeventServr will work. outputMode is used to send events to different targets. For example if you are using httpvent mode, you are using HEC to send events to Splunk. UDP outputMode is useful when you want to send syslog to splunk via UDP port.

View solution in original post

0 Karma

rendi7936
New Member

I am pretty sure about it, httpevent also work when using valid or wrong httpeventServers. I say this because i

In this case, i use 2 instance installed with Splunk Enterprise 8.0.1. 1 instance ( SPLUNK8-Eventgen ) installed with Eventgen as Splunk Apps. Another instance ( SPLUNK8 ) have enabled HEC until it shows up the HEC token.

And then, i create eventgen.conf to generate event and sent it to SPLUNK8 by using httpeventServers configuration ( valid HEC token included ).

SPLUNK8 does not receive the generated event. But, the generated event is show up in SPLUNK8-Eventgen.

Even, i use wrong HEC token. This is will happening again. That's why i ask a help in Splunk Answer.

Is it outputMode in Eventgen only work as Python Module only not as Splunk Apps ? or this is a bug ?

0 Karma

lwu_splunk
Splunk Employee
Splunk Employee

Yes, outputMode only works with Python Module. This is by design since Splunk App is using the modinput outputMode.

0 Karma

lwu_splunk
Splunk Employee
Splunk Employee

Yes, outputMode only works with Python Module. This is by design since Splunk App is using the modinput outputMode.


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!