search

splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
380 stars 179 forks source link

[FEATURE/IMPROVEMENT] persists incremental value between splunk restart #417

Open lmnogues opened 4 years ago

lmnogues commented 4 years ago

I'm using eventgen on a active development platform which needs to be restarted often. We have data simulated from a BDD with incremental Ids. It would be great to have a "persistance" of the offset between each eventgen run Currently when splunk restarts, eventgen increments restart at the "replacement" value set in the conf. something like a "persistance" option would be great : 

[my_bdd]
index = idx_bdd
count = 10
mode = sample
interval= 30
autotimestamp = true
sourcetype = st_my_bdd
source = my_bdd
token.0.token = "ID":(\d+)
token.0.replacementType = integerid
token.0.replacement = 0
token.0.persistance = true