Skip to content

sampleDir not honored when PCRE is used in filename stanza [BUG] #479

Description

@csbflyer

The sampleDir key is not honored when set in a stanza containing PCRE

The script finds the first file in the directory and then tries to find it in the default sample directory:
ERROR LOG #################
2024/05/27 15:11:05 Buffer passed to eventgen-go [conn.log..*]
sampleDir = /opt/splunk/etc/apps/TA-dta/samples
interval = 604800
sourcetype = bro:json
token.0.replacement = %s.%f
token.0.replacementType = timestamp
disabled = false
mode = replay
sampleDir = /home/splunk/dta_logs/zeek_logs/data
token.0.token = \d{10}.\d{1,6}
outputMode = modinput
[global]
sampleDir = /opt/splunk/etc/apps/TA-dta/samples
disabled = false
outputMode = modinput
time="2024-05-27T15:11:05Z" level=info msg="Parsing configuration for sample: conn.log.20:00:00-21:00:00"
time="2024-05-27T15:11:05Z" level=error msg="Sample file does not exist at path: /opt/splunk/etc/apps/TA-dta/samples/conn.log.20:00:00-21:00:00"
time="2024-05-27T15:11:05Z" level=warning msg="Could not resolve Splunk fields, no lines detected"

CURRENT CONFIG #################
[conn.log..*]
disabled = false
sampleDir = /home/splunk/dta_logs/zeek_logs/data
mode = replay
sourcetype = bro:json
interval = 604800
token.0.token = \d{10}.\d{1,6}
token.0.replacementType = timestamp
token.0.replacement = %s.%f

This works if I put the files in /opt/splunk/etc/apps/TA-dta/samples

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

bugMalfunctioning Eventgen due to potential bug

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions