Getting Data In

How can I collect to generate more sample data?

greggz
Communicator

I'm trying to perform a collect with the intention of making my data more heterogeneous. Meaning if I have data from only one host, I want to collect the same data but with a different host and some other different fields. Like _time for instance.

index=mock | eval _time = _time + 86400, cluster = "EDS" | collect index=mock host = "new_host"

So the new data comes with the same _raw and new host, but the _time field stays the same as the original, meaning I can't collect the data and tell that it belongs to the next day. The field cluster also does not get collected. Any ideas?

Tags (3)
0 Karma

elliotproebstel
Champion

In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time, which is the earliest time of the search window. This is consistent with the documentation about collect.

I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @greggz,

I'm not sure cluster field directly indexed in index but I have tried to add it in _raw. Can you please try below search?

index=mock | eval _time = _time + 86400, _raw=_raw." cluster=\"EDS\"" | collect index=mock host = "new_host"

Thanks

0 Karma

tiagofbmm
Influencer

Hey

I believe that your best solution is to use eventgen.

The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field.

Collect is not intended for generating "sample" data. Check eventgen

https://splunkbase.splunk.com/app/1924/

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...