Populating data with Eventgen

Machine data is the information produced by the many functions carried out by computers and other mechanical machines. If you work in an environment that is rich in machine data, you will most likely have many sources of readily-available machine inputs for Splunk. However, to facilitate learning in this book, we will use a Splunk add-on called the Splunk Eventgen to easily build real-time and randomized web log data. This is the type of data that would be produced by a web-based e-commerce company.

Note

If you need more detailed information about Eventgen, you can follow the project's GitHub repository at https://github.com/splunk/eventgen/.

Here's an important tip. Make it a habit to always launch your command prompt in Administrator mode. This allows you to use commands that are unhindered by Windows security:

1. Right-click on the Windows Start menu icon and select Search. In Windows 7, you can click on the Windows icon and the search window will be directly above it. In Windows 10, there is a search bar named Cortana next to the Windows icon that you can type into. They both have the same underlying function.

2. In the search bar, type cmd.

3. In the search results, look for command.exe (Windows 7) or a command prompt (Windows 10), right-click on it, then select Run as administrator.

   Note

   Familiarize yourself with this step. Throughout the rest of the book, you will be frequently asked to open a command prompt in Administrator mode. You will know if you are in Administrator mode, as it will say Administrator: Command Prompt in the title of the command prompt window.

Installing an add-on

A Splunk add-on extends and enhances the base functionality of Splunk. They also typically enrich data from source for easier analysis. In this section, you will be installing your first add-on called Splunk Eventgen that will help us pre-populate Splunk with real-time simulated web data:

1. First we need to install the Eventgen add-on. If you have Git (https://git-scm.com) installed on your machine, you may clone the entire project onto your machine with the following command:

   C:\> git clone https://github.com/splunk/eventgen.git
   

2. You may also download the ZIP file from the Eventgen's public repository, http://github.com/splunk/eventgen, and extract it onto your machine. The download ZIP button is in the lower-right corner of the GitHub repository page.

   

3. After extracting the ZIP file, copy the entire eventgen directory into the $SPLUNK_HOME/etc/apps/ folder. You may need to rename it from eventgen-master to SA-EventGen if you manually downloaded the ZIP file. The trailing slashes are important. Now open an administrator command prompt and execute the following command:

   C:\> xcopy eventgen c:\Splunk\etc\apps\SA-Eventgen /O /X /E /H /K
   

   In the prompt, type D. Verify the contents of the folder using the following command:

   C:\> dir c:\Splunk\etc\apps\SA-Eventgen
   

   These are the contents of the recently-copied SA-Eventgen folder as shown in the following screenshot:

   

4. Restart Splunk by selecting the Settings dropdown, and under the SYSTEM section, click on Server controls:

   

5. On the Server controls page, click on the Restart Splunk button as shown in the following screenshot. Click OK when asked to confirm the restart:

   

6. The web interface will first notify you that Splunk is restarting in the background, then it will tell you that the restart has been successful. Every time Splunk is restarted, you will be prompted to log in with your credentials. Go ahead and log in.

7. Go to the Manage Apps page and confirm that the SA-EventGen application is installed:

   

You have successfully installed a Splunk add-on.