Eventgen
Overview
Details
Eventgen is used internally at Splunk for developing numerous applications and demos. It provides a somewhat ridiculous amount of configurability to allow users to simulate real data.
Developers provide an eventgen.conf file and a set of sample files. The eventgen.conf describes configuration settings for each sample and set of token replacements, which match a regular expression and provide a number of methods of substituting data. Samples can run in sample mode, which takes a number of events from the file and sends them to Splunk after substitution, replay mode which will sequentially run through the file and emit events as they occurred in time order by waiting the amount of time between events before emitting the next event, or using custom generators where the developer can write python code to generate events.
The Splunk Event Generator
The Splunk Event Generator is a utility which allows its user to easily build real-time event generators.
The current maintainers of this project are Brian Bingham (bbingham@splunk.com) and Tony Lee (tonyl@splunk.com).
The goals of this project are ambitious but simple:
- Eliminate the need for hand coded event generators in Splunk apps.
- Allow for portability of event generators between applications, and allow templates to be quickly adapted between use cases.
- Allow every type of event or transaction to be modeled inside Eventgen.
To get you started, please setup a documentation
Tutorial
Documentation is packaged through Gitbook.
It is free to use and easy to install Installation Guide.
Once you have Gitbook installed, run Gitbook to serve documentation directory.
Contributing
Please note CONTRIBUTING.md. You can also find past and current contributors in the document.
License
The Splunk Event Generator is licensed under the Apache License 2.0. Details can be found in the LICENSE file.
Support
This software is released as-is. Splunk provides no warranty and no support on this software.
If you have any issues with the software, please feel free to reach out to the current maintainers and we would be happy to help you.
Release Notes
Version 6.2.1
- Fixing SA-Eventgen Dashboard and log searching
- Improving internal logging and fixing splunkd logging issue
- Fixing timestamping in default generator
- Fixing custom plugin integration
- Fixing SA-Eventgen app settings
- Supporting Eventgen 5 backward compatibility with additional features
- Better modinput process management
- Minor Bugfixes with various customer cases