All Apps and Add-ons

Eventgen app is not collecting the data in real time!

changwoo
Communicator

As a result, only 21 events are indexed.
but in my internaldata.csv, there are about 19mb of data.
Also it is not indexing the data in real time. ( it is indexing the data every 11 minutes. )
plz help

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

View solution in original post

Lowell
Super Champion

Looks like you may need to set the time field in the csv file for replay mode to work correctly. Also note that setting timeMultiple to 2 means it will come in twice as slow as they did originally. You could make them come in twice as fast with 0.5. So maybe try this:

timeField = _time
timeMultiple = 0.5

Alternately, you could try "sample" mode instead of "replay" mode. This will randomly grab lines from your sample file instead of trying to replay them based on the original timing within the sample file. This would give you a more consistent flow of events. It all depends on your use case as to which option is the best.

mode = sample
interval = 10
count = 3

This would give you 3 events every 10 seconds.

Final thought. May sure you are looking at the log messages created by eventgen when it first starts up. If there's a configuration issue it could be logged.

changwoo
Communicator

THANKS !!!!

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...