I am reaching my wits end on this issue, as I have been trying to get Eventgen to work for over a month now. I have many raw log files (XXX.windows) I want eventgen to replay into Splunk but I can't seem to get it to work.
I made a splunk app and placed these log files in /opt/splunk/etc/apps/custom_splunk_app/samples
I configured my eventgen.conf in both /opt/splunk/etc/apps/custom_splunk_app/local & /opt/splunk/etc/apps/custom_splunk_app/default to look like this.
[*\.windows]
mode = sample
sampletype = raw
index = wineventlog
sourcetype = wineventlog
outputMode = splunkstream
breaker = \n
disabled = false
I have enabled the modinput in my Data Inputs menu in the Splunk web GUI.
My /opt/splunk/var/log/splunk/modinput_eventgen.log says:
2019-10-07 15:24:23,427 DEBUG [Eventgen] Initialized ModularInput Logger
2019-10-07 15:24:23,427 DEBUG [Eventgen] Setting up SA-Eventgen Modular Input
2019-10-07 15:24:23,429 INFO [Eventgen] Initialized streaming
2019-10-07 15:24:23,429 INFO [Eventgen] Input Config is: {'session_key': 'YZtJpzzVUvHPsl8CU4_OKItqGYmoZHkA6f4y6fu_9caR6KnHRxnpQEXAh85rjAiUMkNI7ChH^PKMvO7^cnzlgSxvbzdUN^1pLyXQMZ3nK_W7f_RiagURSC', 'configuration': "{u'modinput_eventgen://default': {u'interval': u'10', 'name': u'modinput_eventgen://default', u'disabled': u'0', u'host': u'ip-172-31-19-39.ec2.internal', u'index': u'wineventlog', u'verbosity': u'40'}}", 'checkpoint_dir': '/opt/splunk/var/lib/splunk/modinputs/modinput_eventgen', 'server_host': 'ip-172-31-19-39.ec2.internal', 'server_uri': 'https://127.0.0.1:8089'}
2019-10-07 15:24:23,429 DEBUG [Eventgen] Creating default args for modinput
2019-10-07 15:24:23,430 INFO [Eventgen] Prepared Config
2019-10-07 15:24:23,430 INFO [Eventgen] Eventgen object generated
2019-10-07 15:24:23,431 INFO [Eventgen] Config object generated
2019-10-07 15:24:23,431 INFO [Eventgen] Config made Splunk Embedded
2019-10-07 15:24:23,496 INFO [Eventgen] Finished config parsing
2019-10-07 15:24:23,497 INFO [Eventgen] Finished parse
2019-10-07 15:24:23,555 INFO [Eventgen] Finished reload
2019-10-07 15:24:23,572 INFO [Eventgen] Finished setup pools
2019-10-07 15:24:23,573 INFO [Eventgen] Finished running start
2019-10-07 15:24:23,573 INFO [Eventgen] Finished streaming
What am I doing wrong?
↧