Getting Data In

Eventgen Perf Issue

Loves-to-Learn Lots

Hello all, I need some help about eventgen, for TA_Windows I need to create some samples for testing. My Env is Splunk 8.1.1 (LInux) and TA_windows and SA_Eventgen are all the newst versions. Over 40 sample stanzas are in need, for time interval I used -15mins and now, interval 30 or 60, count for each sample is 10 or 15. The whole eventgen.conf file is pretty long about 6000 lines. 

The issue is on Linux, always about half of samples running, some samples are never running, but there is no errors in conf. I tested again on Windows Splunk 8.1.1, the same conf file could let every sample runnable. 

Is there some limitations maybe for eventgen conf file length or the number of samples?

Or should I design a better scheduling for each sample? If so I need some advices, has someone a design of schedule to ensure each sample could run regularly?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...