splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
380 stars 179 forks source link

Support request: error: function \"seqfile\" not defined (please help me) #472

Closed Nicolas-Pellletier closed 1 year ago

Nicolas-Pellletier commented 1 year ago

Describe the bug I'm trying to set up the SA-eventgen app and doing the simple tutorial with sample files but got this error error parsing token newline: {{$templateData := .}}\ufeff{ and maybe that result in this fatal error function \"seqfile\" not defined (see below the errors):

image

And I don't know why... Here is my eventgen located in misp42splunk app: sudo cat ./etc/apps/misp42splunk/default/eventgen.conf


[film.json]                                                                                                                                                                                  
index = main
count = 100
mode = sample
end = 1
autotimestamp = true
sourcetype = json
source = /opt/splunk/sources/film.json

token.0.token = "FILM_ID":(\d+)
token.0.replacementType = integerid
token.0.replacement = 0

token.1.token = "REGION_ID":(\d+)
token.1.replacementType = seqfile
token.1.replacement = /opt/splunk/etc/apps/sample_bundle/samples/count10.txt                                                                                                                                                                                                                                                                       ```

**If you are using SA-Eventgen with Splunk (please complete the following information):**
 - OS: Ubuntu 22.04 
 - Browser [e.g Firefiox]
 - Eventgen Version 7.2.1
 - Splunk Version 9.0.4.1 (build 419ad9369127)
 - misp42splunk
drymus commented 1 year ago

I'm seeing the same error on my MacOS Ventura 13.3.1 (a)

Nicolas-Pellletier commented 1 year ago

I kept exploring the documentation and discovered that token replacement type no longer has a seqfile value defined. So if you replace 'seqfile' with 'file' in your conf file, it should start working.