Eventgen Replay mode: all same timestamp

[brandy81]

Hi, Please help me out.

I try to generate events with replay mode, but it is not working properly. All timestamp is same. Of course original sample file is time series data, which means each event has different timestamp.

[sampledata1.log]
mode = replay
outputMode = splunkstream
token.0.token = \d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}.\d{3} token.0.replacementType = timestamp
token.0.replacement = %m-%d-%Y %H:%M:%S.%f

sampledata1.log
"08-07-2019 22:00:03.595 +0900 INFO loader - Running utility: ""validatedb"""
"08-07-2019 22:00:04.496 +0900 INFO loader - Getting configuration data from: /home/splunk/etc/myinstall/splunkd.xml"
"08-07-2019 22:00:05.586 +0900 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to /home/splunk/etc/modules"
"08-07-2019 22:00:06.596 +0900 INFO loader - loading modules from /home/splunk/etc/modules"
"08-07-2019 22:00:07.597 +0900 INFO loader - Writing out composite configuration file: /home/splunk/var/run/splunk/composite.xml"
................

After restart splunk, I could see this view. Generated events have same timestamp.

What I have to do? What wrong with this?

[dpeukert]

You are using the following line:
token.0.replacementType = timestamp
Instead you should use:
token.0.replacementType = replaytimestamp

This should fix your problem.

Tip: The replaytimestamp is based on the difference of the timestamps in your sample file. So you might want to increase the difference in your sample.

[brandy81]

Thank you for the answer. But I don't understand these combination below:
1. mode=reply / token.x.replacementType = replaytimestamp
2. mode=reply / token.x.replacementType = timestamp
3. mode=sample / token.x.replacementType = replaytimestamp
4. mode=sample / token.x.replacementType = timestamp

I tested 4 cases and got to know what' differences between them, but, I would like to get to know about each option based on cases. Could anybody please let me know about those cases?

[brandy81]

It must be extracting timestamp issue. But It's correct! 😞 Could anyone please let me know what's wrong?