- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a generic eventgen that can be used for a MLT workshop?

Hi folks,
We're going to do a Splunk Machine Learning Toolkit (MLT) workshop for some customers, and we're planning on creating a live environment for them to lab on. To do this we need an event generator that produces a variety of events so that several of the functions of the MLT can be tested with natural results. I've been looking for a Buttercup eventgen, but can't find any. Does anyone know if there exist a pre-configured Buttercup eventgen or similar that can be used for workshops like this?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This is the latest hotness in flexibility and appears to be the future of eventgens for Splunk:
https://github.com/coccyx/gogen
@coccyx is on Splunk slack, too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Great, thanks! I'll try it out. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Were you able to generate buttercup games data with gogen ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Unfortunately I never got to testing gogen. Let me know how it works out if you do. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Can you use Showcase examples that are built in to Machine Learning Toolkit?
For Realtime data I mostly use:
1) Splunk's internal index (which also has access logs)
2) Windows Server Performance Counters like CPU or Memory.
Can you use one of the above?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The showcases that are built into MLT includes some static lists, but no live data. I guess we could use these lists, or use internal data, but it would be more "real" if we where to use live data that's not internal. Examples could be traffic on web sites, sales, disk usage, performance, etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@hettervi, why dont you turn on CPU Collection (% Processor Time) on the Splunk Sandbox Server itself ( if it is Windows Server, or if you have Splunk License forward the same from a remote machine), as I have mentioned in scenario 2 above. That way you can show CPU Utilization. One of the hurdles that I see is that how would you get Historical Data to train?
You can also enable Event Viewer metrics collection on Windows Server and pass on System and/or Application logs and show prediction for Event Log Errors.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Also if you consider Splunk app itself it monitors Splunk's usage through _internal sourcetype.
So considering Splunk as a web app, there can be several usecases with (i) sourcetype=splunkd_access or (ii) sourcetype=splunkd AND source=*metrics.log
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Metricslog
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you very much for the suggestions! I'll keep the question open some time loger. A Buttercup event generator would indeed be nice. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

While you can try out these, do wait for others to respond though 😉 If an Event Generator for Buttercup game kind of data is available that would be great 🙂
| makeresults | eval message= "Happy Splunking!!!"
