splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
376 stars 180 forks source link

Stanzas from separate sources with duplicate names do not generate [BUG] #378

Open jmeixensperger opened 4 years ago

jmeixensperger commented 4 years ago

Describe the bug When generating data with multiple eventgen.conf files, if the conf files contain the same stanza name, only 1 stanza gets used. This can occur easily if we re-use bundles across sources/configs.

To Reproduce 1) Copy bundles to separate TAs: stanzaBug2.tar.gz stanzaBug1.tar.gz 2) Add 'myIndex1' and 'myIndex2' indices 3) Enable eventgen and look at data ingested in both indices

Expected behavior Both conf files get picked up and data is ingested in both indices

Actual behavior Only 1 stanza is used and data is ingested in 1 index

Do you run eventgen with SA-eventgen? Yes