Hello all, I need some help about eventgen, for TA_Windows I need to create some samples for testing. My Env is Splunk 8.1.1 (LInux) and TA_windows and SA_Eventgen are all the newst versions. Over 40 sample stanzas are in need, for time interval I used -15mins and now, interval 30 or 60, count for each sample is 10 or 15. The whole eventgen.conf file is pretty long about 6000 lines. The issue is on Linux, always about half of samples running, some samples are never running, but there is no errors in conf. I tested again on Windows Splunk 8.1.1, the same conf file could let every sample runnable. Is there some limitations maybe for eventgen conf file length or the number of samples? Or should I design a better scheduling for each sample? If so I need some advices, has someone a design of schedule to ensure each sample could run regularly?
... View more
