{"action":"opened","issue":{"url":"https://api.github.com/repos/splunk/eventgen/issues/82","repository_url":"https://api.github.com/repos/splunk/eventgen","labels_url":"https://api.github.com/repos/splunk/eventgen/issues/82/labels{/name}","comments_url":"https://api.github.com/repos/splunk/eventgen/issues/82/comments","events_url":"https://api.github.com/repos/splunk/eventgen/issues/82/events","html_url":"https://github.com/splunk/eventgen/issues/82","id":341880656,"node_id":"MDU6SXNzdWUzNDE4ODA2NTY=","number":82,"title":"Backfilling normal and incident data with eventgen","user":{"login":"alvinkwong47","id":34927924,"node_id":"MDQ6VXNlcjM0OTI3OTI0","avatar_url":"https://avatars3.githubusercontent.com/u/34927924?v=4","gravatar_id":"","url":"https://api.github.com/users/alvinkwong47","html_url":"https://github.com/alvinkwong47","followers_url":"https://api.github.com/users/alvinkwong47/followers","following_url":"https://api.github.com/users/alvinkwong47/following{/other_user}","gists_url":"https://api.github.com/users/alvinkwong47/gists{/gist_id}","starred_url":"https://api.github.com/users/alvinkwong47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alvinkwong47/subscriptions","organizations_url":"https://api.github.com/users/alvinkwong47/orgs","repos_url":"https://api.github.com/users/alvinkwong47/repos","events_url":"https://api.github.com/users/alvinkwong47/events{/privacy}","received_events_url":"https://api.github.com/users/alvinkwong47/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-17T11:35:04Z","updated_at":"2018-07-17T11:35:04Z","closed_at":null,"author_association":"NONE","body":"I am using eventgen version 6.2.1 in Splunk. Currently, I am using two sets of stanza for generating normal and incident data without overlap by minuteOfHourRate so that the incident will happen every 10 minutes. \r\n\r\nFor some reason, I need to backfill one hour of data every time I startup Splunk. However, I found that either only the normal data or the incident data will be backfill in Splunk, depending on the time the Splunk starts. Is there any way I can generate the events so that it follows the pattern that every 10 minutes an incident will occur?\r\n\r\nBelow are my current configuration,\r\n\r\neventgen.conf\r\n`[global]\r\ndisabled = false\r\ndebug = true\r\nverbose = true\r\nmaxIntervalsBeforeFlush = 1\r\n\r\n#####################################\r\n######### Normal Sample #############\r\n#####################################\r\n[normal.sample]\r\nmode = sample\r\ninterval = 10\r\nsampletype = raw\r\nindex = test\r\nearliest = now\r\nlatest = now\r\nsourcetype = _json\r\nminuteOfHourRate = { \"0\": 1, \"1\": 1, \"2\": 1, \"3\": 1, \"4\": 1, \"5\": 1, \"6\": 1, \"7\": 1, \"8\": 1, \"9\": 0, \"10\": 0, \"11\": 0, \"12\": 1, \"13\": 1, \"14\": 1, \"15\": 1, \"16\": 1, \"17\": 1, \"18\": 1, \"19\": 0, \"20\": 0, \"21\": 0, \"22\": 1, \"23\": 1, \"24\": 1, \"25\": 1, \"26\": 1, \"27\": 1, \"28\": 1, \"29\": 0, \"30\": 0, \"31\": 0, \"32\": 1, \"33\": 1, \"34\": 1, \"35\": 1, \"36\": 1, \"37\": 1, \"38\": 1, \"39\": 0, \"40\": 0, \"41\": 0, \"42\": 1, \"43\": 1, \"44\": 1, \"45\": 1, \"46\": 1, \"47\": 1, \"48\": 1, \"49\": 0, \"50\": 0, \"51\": 0, \"52\": 1, \"53\": 1, \"54\": 1, \"55\": 1, \"56\": 1, \"57\": 1, \"58\": 1, \"59\": 1 }\r\nbackfill = -1h\r\n\r\ntoken.0.token = \"time\":(\\d+)\r\ntoken.0.replacementType = timestamp\r\ntoken.0.replacement = %s\r\n\r\ntoken.1.token = \"temp\":\"(\\d+).0\"\r\ntoken.1.replacementType = random\r\ntoken.1.replacement = integer[25:28]\r\n\r\n#####################################\r\n######### Incident Sample ###########\r\n#####################################\r\n[incident.sample]\r\nmode = sample\r\ninterval = 10\r\nsampletype = raw\r\nindex = test\r\nearliest = now\r\nlatest = now\r\nsourcetype = _json\r\nminuteOfHourRate = { \"0\": 0, \"1\": 0, \"2\": 0, \"3\": 0, \"4\": 0, \"5\": 0, \"6\": 0, \"7\": 0, \"8\": 0, \"9\": 1, \"10\": 1, \"11\": 1, \"12\": 0, \"13\": 0, \"14\": 0, \"15\": 0, \"16\": 0, \"17\": 0, \"18\": 0, \"19\": 1, \"20\": 1, \"21\": 1, \"22\": 0, \"23\": 0, \"24\": 0, \"25\": 0, \"26\": 0, \"27\": 0, \"28\": 0, \"29\": 1, \"30\": 1, \"31\": 1, \"32\": 0, \"33\": 0, \"34\": 0, \"35\": 0, \"36\": 0, \"37\": 0, \"38\": 0, \"39\": 1, \"40\": 1, \"41\": 1, \"42\": 0, \"43\": 0, \"44\": 0, \"45\": 0, \"46\": 0, \"47\": 0, \"48\": 0, \"49\": 1, \"50\": 1, \"51\": 1, \"52\": 0, \"53\": 0, \"54\": 0, \"55\": 0, \"56\": 0, \"57\": 0, \"58\": 0, \"59\": 0 }\r\nbackfill = -1h\r\n\r\ntoken.0.token = \"time\":(\\d+)\r\ntoken.0.replacementType = timestamp\r\ntoken.0.replacement = %s\r\n\r\ntoken.1.token = \"temp\":\"(\\d+).0\"\r\ntoken.1.replacementType = random\r\ntoken.1.replacement = integer[30:40]`\r\n\r\nnormal.sample\r\n`{\"temp\":\"23.0\",\"ip\":\"192.168.1.101\",\"time\":1528092000}\r\n{\"temp\":\"23.0\",\"ip\":\"192.168.1.102\",\"time\":1528092000}`\r\n\r\nincident.sample\r\n`{\"temp\":\"23.0\",\"ip\":\"192.168.1.101\",\"time\":1528092000}\r\n{\"temp\":\"23.0\",\"ip\":\"192.168.1.102\",\"time\":1528092000}`"}}
{"actor":{"display_login":"alvinkwong47"}}