Getting Data In

Eventgen Perf Issue

Loves-to-Learn Lots

Hello all, I need some help about eventgen, for TA_Windows I need to create some samples for testing. My Env is Splunk 8.1.1 (LInux) and TA_windows and SA_Eventgen are all the newst versions. Over 40 sample stanzas are in need, for time interval I used -15mins and now, interval 30 or 60, count for each sample is 10 or 15. The whole eventgen.conf file is pretty long about 6000 lines. 

The issue is on Linux, always about half of samples running, some samples are never running, but there is no errors in conf. I tested again on Windows Splunk 8.1.1, the same conf file could let every sample runnable. 

Is there some limitations maybe for eventgen conf file length or the number of samples?

Or should I design a better scheduling for each sample? If so I need some advices, has someone a design of schedule to ensure each sample could run regularly?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...