topic Re: SA-Eventgen and Splunk SPL Examples - Help Generating Data in Splunk Search

SA-Eventgen and Splunk SPL Examples - Help Generating Data

dillardo_2 — Wed, 30 Sep 2020 02:10:04 GMT

Hello community, I've installed SA-Eventgen and SPL Examples as directed in the following .conf talk:

https://conf.splunk.com/files/2017/recordings/creating-your-own-splunk-learning-environment.mp4

However, this doesn't work. I've taken a look at the documentation, created a folder named "local" under the SPL_Examples directory and moved the eventgen.config from the apps\spl_examples\default folder to the apps\spl_exampels\local folder. I restarted Splunk and still getting no events. What am I missing? Luke Netto's talk referenced above makes it seem so trivial?

I'm working with a brand new install of Splunk on a Windows 10 system. The only apps I've installed as of this post are SA-Eventgen and SPL Examples.

Splunk Enterprise Version: 7.3.1
SA-Eventgen Version: 6.5.1
Splunk SPL Examples Version: 1.0.0

Appreciate any help with this!

Here are some of the errors I'm seeing in the internal index:

From Splunkd.log:

09-11-2019 12:21:10.206 -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Eventgen\bin\modinput_eventgen.py"" 2019-09-11 12:21:10 eventgen WARNING MainProcess {'positional_args': (0,), 'event': 'Generator Queue Full. Reput the backfill generator task later. %d backfill generators are dispatched.'}

Re: SA-Eventgen and Splunk SPL Examples - Help Generating Data

lwu_splunk — Tue, 10 Sep 2019 22:32:46 GMT

Here is the latest documentation for Eventgen: http://splunk.github.io/eventgen/

Re: SA-Eventgen and Splunk SPL Examples - Help Generating Data

dillardo_2 — Wed, 11 Sep 2019 12:01:21 GMT

Iwu, I've read the documentation, however, SA-Eventgen isn't working. Do you have a Splunk Enterprise environment configured with SA-Eventgen and SPL Examples working?

Re: SA-Eventgen and Splunk SPL Examples - Help Generating Data

lwu_splunk — Thu, 12 Sep 2019 01:42:54 GMT

Try to extract this file under $SPLUNK_HOME/etc/apps folder and enable Eventgen modular input to check if data is generating into splunk: https://gofile.io/?c=C9X63g

Re: SA-Eventgen and Splunk SPL Examples - Help Generating Data

lnetto_splunk — Thu, 19 Mar 2020 16:15:04 GMT

We are no longer publishing eventgen configs with TAs :(.
I'm going to try to reach out to you directly.