Getting Data In

How can I collect to generate more sample data?

greggz
Communicator

I'm trying to perform a collect with the intention of making my data more heterogeneous. Meaning if I have data from only one host, I want to collect the same data but with a different host and some other different fields. Like _time for instance.

index=mock | eval _time = _time + 86400, cluster = "EDS" | collect index=mock host = "new_host"

So the new data comes with the same _raw and new host, but the _time field stays the same as the original, meaning I can't collect the data and tell that it belongs to the next day. The field cluster also does not get collected. Any ideas?

Tags (3)
0 Karma

elliotproebstel
Champion

In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time, which is the earliest time of the search window. This is consistent with the documentation about collect.

I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @greggz,

I'm not sure cluster field directly indexed in index but I have tried to add it in _raw. Can you please try below search?

index=mock | eval _time = _time + 86400, _raw=_raw." cluster=\"EDS\"" | collect index=mock host = "new_host"

Thanks

0 Karma

tiagofbmm
Influencer

Hey

I believe that your best solution is to use eventgen.

The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field.

Collect is not intended for generating "sample" data. Check eventgen

https://splunkbase.splunk.com/app/1924/

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...