Getting Data In

Eventgen Replay mode: all same timestamp

brandy81
Path Finder

Hi, Please help me out.

I try to generate events with replay mode, but it is not working properly. All timestamp is same. Of course original sample file is time series data, which means each event has different timestamp.

[sampledata1.log]
mode = replay
outputMode = splunkstream
token.0.token = \d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}.\d{3} token.0.replacementType = timestamp
token.0.replacement = %m-%d-%Y %H:%M:%S.%f

sampledata1.log
"08-07-2019 22:00:03.595 +0900 INFO loader - Running utility: ""validatedb"""
"08-07-2019 22:00:04.496 +0900 INFO loader - Getting configuration data from: /home/splunk/etc/myinstall/splunkd.xml"
"08-07-2019 22:00:05.586 +0900 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to /home/splunk/etc/modules"
"08-07-2019 22:00:06.596 +0900 INFO loader - loading modules from /home/splunk/etc/modules"
"08-07-2019 22:00:07.597 +0900 INFO loader - Writing out composite configuration file: /home/splunk/var/run/splunk/composite.xml"
................

After restart splunk, I could see this view. Generated events have same timestamp.
alt text

What I have to do? What wrong with this?

Tags (2)
0 Karma

dpeukert
Explorer

You are using the following line:
token.0.replacementType = timestamp
Instead you should use:
token.0.replacementType = replaytimestamp

This should fix your problem.

Tip: The replaytimestamp is based on the difference of the timestamps in your sample file. So you might want to increase the difference in your sample.

0 Karma

brandy81
Path Finder

Thank you for the answer. But I don't understand these combination below:
1. mode=reply / token.x.replacementType = replaytimestamp
2. mode=reply / token.x.replacementType = timestamp
3. mode=sample / token.x.replacementType = replaytimestamp
4. mode=sample / token.x.replacementType = timestamp

I tested 4 cases and got to know what' differences between them, but, I would like to get to know about each option based on cases. Could anybody please let me know about those cases?

0 Karma

brandy81
Path Finder

It must be extracting timestamp issue. But It's correct! 😞 Could anyone please let me know what's wrong?

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...