[BUG] Replay mode timeline bug

[breakfixrepeat]

Describe the bug Replay mode appears to have a bug whereby the first two events are replayed at the same time, and for each event thereafter the time offset applied from one event to the next is off by 1 event.

To Reproduce Steps to reproduce the behavior:

1. Create a basic replay config (see below)
2. Create a simple list of events (see example below)
3. Note that the first two events are replayed at the same time, and every subsequent events offset is incorrect.

Expected behavior Each log should be replayed 5 seconds apart, except the 5th log entry should be replayed 5 minutes after the previous

Jan 17 00:00:00 TEST 1
Jan 17 00:00:05 TEST 2
Jan 17 00:00:10 TEST 3
Jan 17 00:00:15 TEST 4
Jan 17 00:05:15 TEST 5

Actual behavior The first two logs are replayed with the same time, all subsequent logs are offset by the previous logs offset.

Jan 17 00:00:00 TEST 1
Jan 17 00:00:00 TEST 2
Jan 17 00:00:05 TEST 3
Jan 17 00:00:10 TEST 4
Jan 17 00:00:15 TEST 5
Jan 17 00:05:15 TEST 6

Sample files and eventgen.conf file eventgen.conf

[test.log]
mode = replay
outputMode = stdout

token.0.token = \w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}
token.0.replacementType = replaytimestamp
token.0.replacement = %b %d %H:%M:%S

test.log

Jan 17 00:00:00 TEST 1
Jan 17 00:00:05 TEST 2
Jan 17 00:00:10 TEST 3
Jan 17 00:00:15 TEST 4
Jan 17 00:05:15 TEST 5

Do you run eventgen with SA-eventgen? No

If you are using eventgen with pip module mode (please complete the following information):

• python version: 3.8
• OS: Ubuntu 20.04 & Alpine 3.13
• Virtual Env is used: Yes
• Eventgen Version 7.2.1

[breakfixrepeat]

Looks like the first part of the bug resides in https://github.com/splunk/eventgen/blob/52542a6565ab75d7f1ad7debbdf75cfa9b79d226/splunk_eventgen/lib/plugins/generator/replay.py#L176

The first events time difference should be set to the next event, i.e. line_list[index + 1]["timediff"] to resolve the issue with the first two events being replayed at the same time.

After that the time diff needs to be updated to the next event in the list.

I will submit a pull request when I get a chance.