How to Get Eventgen working?

[meghasahai]

Hi,

I am new in Splunk Enterprise, I need your help to get the sample data uploaded on Splunk. I got the sample data from Splunk-7-Essentials-Third-Edition-master and it is inside the folder: C:\Splunk-7-Essentials-Third-Edition-master\Chapter01\eventgen

If this the location of my app -> $SPLUNK_HOME\etc\apps\destination, and I have placed eventgen.conf inside the local, i.e.  -> $SPLUNK_HOME\etc\apps\destination\local. The sample data is under new folder 'samples': $SPLUNK_HOME\etc\apps\destination\samples

Now, this is what my eventgen.conf looks like:

---------

# Note, these samples assume you're installed as an app or a symbolic link in
# $SPLUNK_HOME/etc/apps/eventgen. If not, please change the paths below.

# Modified by ericksond

[destinations.sample]
mode = sample
sampletype = csv
outputMode = splunkstream
interval = 10
earliest = -10s
latest = now
count = 3
randomizeCount = 0.33
randomizeEvents = true

token.0.token = ((\w+\s+\d+\s+\d{2}:\d{2}:\d{2}:\d{3})|(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}:\d{3}))
token.0.replacementType = replaytimestamp
token.0.replacement = ["%b %d %H:%M:%S:%f", "%Y-%m-%d %H:%M:%S:%f"]

token.1.token = (5\.5\.5\.5)
token.1.replacementType = file
token.1.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/external_ips.sample

token.2.token = (10\.2\.1\.35)
token.2.replacementType = file
token.2.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/webhosts.sample

token.3.token = (Method-And-URI)
token.3.replacementType = file
token.3.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/destinations-uris.sample

token.4.token = (User-Agent)
token.4.replacementType = file
token.4.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/useragents_desktop.sample

token.5.token = (468)
token.5.replacementType = random
token.5.replacement = integer[100:1000]

token.6.token = (1488)
token.6.replacementType = random
token.6.replacement = integer[200:4000]])"

token.7.token = (200)
token.7.replacementType = file
token.7.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/destinations-codes.sample

------------

After all these steps, i have restared the Splunk, could you possibly tell me where i am going wrong.

Thanks in advance!

@Penkov  @harsmarvania57  @naidusadanala