Hello everyone, I have a question for tags configuration in Eventgen. For a basic, the structure is: [your condition] yourtag1=enabled yourtag2=disabled For example: [action=created] change=enabled So, the question is: If i want to tag an event with more than one condition, how can i do it? I tried "AND" "OR" operator but it does not work. And, "enabled" assigns the tag to an event, what does "disabled" do? Thank you for your reading ❤️  ... View more

Hello everyone, I am a newbie in this field, I am looking forward to your help. I am using Eventgen to create data samples for Splunk Enterprise.  I have a datamodel "Test", a dataset "datasetA" in that datamodel, "datasetB" inherited from "datasetA" and "datasetC" inherited from "datasetB". All the data samples are satisfy with the base search and constraints of all datasets. It means all data samples are the sample in 3 datasets above. The problem is there are values of datasetA.fieldname, but not for datasetB.fieldname even datasetB is inherited from datasetA. Is there anyone have the same problem? More information: Sorry because i do not capture it 😞  example: |tstats values(datasetA.action) from datamodel=Test ->result: 3 actions |stats values(datasetA.datasetB.action) from datamodel=Test ->result: no result found The data samples in datasetA and datasetB is the same Thank you for reading ❤️  ... View more