splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
376 stars 180 forks source link

EventGen always generating the same event [BUG] #286

Closed szsb26 closed 5 years ago

szsb26 commented 5 years ago

Hi all,

I put only one sample type (CPUTime.perfmon) into the samples folder, but when I run eventgen, it constantly generates the same event. The output of the events in a .txt file looks like:

1) eventgen_data_output.txt

while the CPUTime.perfmon sample template and eventgen.conf look like:

2) CPUTime.perfmon.zip

3) eventgen.conf.zip

Note that in the outputfile(first file), "counter", "instance", and "Value" are all the same across events even though they are supposed to be randomly generated!!

Thanks for the help!

szsb26 commented 5 years ago

I tried the following fix given by the following screenshot (basically with the added line 'updated_sample_dict = GeneratorPlugin.replace_tokens(self, self._sample.sampleDict, earliest, latest)' in each of the sections under 'SZ CODE HERE'),

Screen Shot 2019-08-13 at 3 25 58 PM

and while it works for CPUTime.perfmon example given above, it does not fix the issue completely as it only works for certain replacementTypes. If the replacementType includes "mvfile", then an exception is raised in last line of method generator_do_work in eventgen_core.py. The exception is due to KeyError in method '_getReplacement()' in the line 'return self.mvhash[replacementFile][replacementColumn - 1]'.

To reproduce this error,

the conf file of the new dataset I tried is: eventgen.conf.zip

and the corresponding sample files are: samples.zip

The sample files in the zip file which I get KeyErrors are 1) '100k_user_comp_ip.sample' 2) 'network_inside_ips.sample'

This is because both of these samples are 'mvfiles' as designated in the conf file.

The key error message given for these two files is:

KeyError: '/Users/szhong/Desktop/Sichen/Work/github_clones/eventGen/es_performance_data/mixed_all_data_eg/samples/100k_user_comp_ip.sample'

and

KeyError: '/Users/szhong/Desktop/Sichen/Work/github_clones/eventGen/es_performance_data/mixed_all_data_eg/samples/network_inside_ips.sample'