Skip to content

[BUG] Eventgen does not work on Windows 10 64 bit #427

Description

@DieterSchmitz

We're using Splunk 8.1.2 and SA-Eventgen version 7.2.1 and want to replay CSV files. Everything is installed on a Windows 10 64-bit machine.
When restarting Splunk with our eventgen app, the following error is shown in eventgen-error.log

2021-02-08 15:36:28 eventgen ERROR MainProcess Python int too large to convert to C long
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\eventgen_core.py", line 325, in _worker_do_work
item.run()
File "C:\Program Files\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\lib\eventgentimer.py", line 117, in run
self.real_run()
File "C:\Program Files\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\lib\eventgentimer.py", line 131, in real_run
raw_event_size = self.predict_event_size()
File "C:\Program Files\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\lib\eventgentimer.py", line 90, in predict_event_size
self.sample.loadSample()
File "C:\Program Files\Splunk\etc\apps\SA-Eventgen\lib\splunk_eventgen\lib\eventgensamples.py", line 464, in loadSample
csv.field_size_limit(sys.maxsize)
OverflowError: Python int too large to convert to C long

The responsible line is found in eventgensamples.py in line 464:
csv.field_size_limit(sys.maxsize)

After changing the line above to (just an example)

                csv.field_size_limit(100000000)

eventgen starts sending events to Splunk.

It seems to be, that this error occurs on Windows (64 bit???) systems only. We tested it on a Linux machine and it worked as expected.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

bugMalfunctioning Eventgen due to potential bug

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions