Hi Everyone,
I've added a txt file to SA-Eventgen sample folder and wrote the configuration in the eventgen.conf file as follows.
[mihealth-https_error]
mode = sample
interval = 15
earliest = -15s
latest = now
count = 25
hourOfdayRate = { "0": 0.8, "1": 1.0: "2": 0.9, "3":0.7, "4":0.7, "5":0.7, "6":0.7, "7":0.7, "8":0.7, "9":0.7, "10":0.7, "11":0.7, "12":0.7, "13":0.7, "14":0.7, "15":0.7, "16":0.7, "17":0.7, "18":0.7, "19":0.7, "20":0.7, "21":0.7, "22":0.7, "23":0.7 }
dayOfWeekRate = { "0": 0.7, "1": 0.7, "2": 0.7, "3": 0.6, "4": 0.8, "5": 1.0, "6": 0.9 }
randomizeCount = 0.2
randomizeEvents = true
outputMode = modinput
sourcetype = eventgen_test3
source = eventgendemo3
index = eventgen
token.0.token = \[(\w+\s\w+\s\d+\s\d+:\d+:\d+.\d+\s\d+)\]
token.0.replacementType = timestamp
token.0.replacement = %a %b %d %H:%M:%S.%6N %Y
token.1.token = \(\w+\s\w+.(\w+).\w+:\d+\)
token.1.replacementType = file
token.1.replacement = $SPLUNK_HOME/etc/apps/SA-Eventgen/samples/orderType.sample
the txt data look like this in the sample folder:
[Thu Jun 04 09:37:31.838874 2020] [ssl:info] [pid 24583] [client 10.10.10.1:39900] NC00000: Connection to child 8 established (server core.Company.com:443)
it is not generating any events, could you please help me?
Thanks in advance
