search

splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
380 stars 179 forks source link

[BUG] Backfill events is not time-sequential #283

Closed Yangxulight closed 5 years ago

Yangxulight commented 5 years ago

Describe the bug Event timestamp is not sequential on backfill events

To Reproduce

  1. Create an eventgen service deployment with 1 controller and 10 servers. (or create severall standalone eventgen nodes) 2 Use "backfill=-7d, perdayvlume=500" to generate events. 3 Check the timestamp from last 7 days, they were not indexed by sequential timestamp.

Expected behavior Events that sent to splunk should be timestamp sequential.

Actual behavior Use this spl to search bucket information: "| dbinspect index=main | table bucketId startEpoch endEpoch". The buckets startEpoch for one index demonstrate that the events timestamp was not sequential.

li-wu commented 5 years ago

Since it is using 10 servers to generate the backfill data, it is hard to keep the data generation speed as well as time sent to indexer on the same path. Currently I do not have very good solution for this. @lephino @arctan5x , any comment?