All Apps and Add-ons

Splunk EventGen not working on Windows 10


Good Day Team,

Did anyone manage to get splunk eventgen working on windows 10?
I have been struggling to get it working on my windows 10 PC using splunk v7.3.2. I want to GIT but didnt get much that I understood could help.
I just wanted to follow through on some practical exercises I was setting up.


Tags (1)
0 Karma


please read this link ->

Here is the step I took to deploy eventgen to my macbook.

  1. Deployed the eventgen at Splunk
  2. Deployed the Splunk_TA_Windows version 4.8.4 This version has a evengen.conf file at default folder
  3. Create a local folder at evengen app
  4. Copy the eventgen.conf from Splunk_TA_Windows app to eventgen local folder

the key to have your eventgen working properly is to extract the correct data using token.

See below a sample configuration for Windows data.

Use Splunk_TA_Windows/default/inputs.conf sequence

Default replacement for all DhcpSrvLog logs

index = windows
sourcetype = DhcpSrvLog
interval = 300

Generate all events in sample

count = 0
earliest = -5m
latest = now

replace timestamp 10,07/21/06,19:42:47

token.0.token = ^\d+\,(\d{2}\/\d{2}\/\d{2}\,\d{2}:\d{2}:\d{2})
token.0.replacementType = timestamp
token.0.replacement = %m/%d/%y,%H:%M:%S

0 Karma



Thank you for the prompt response:
Firstly, I tried out this link and installed it as an app but when I run a search string (index=main) I get nothing.
I was following the steps in the book Splunk 7 Essentials religiously but to no avail.

I just want a step by step procedure on installing on a Windows 10 PC.

0 Karma


you have to check if this data was send to other index into splunk.

Please troubleshoot the issue, check the internal index to identify which error messages you are getting. Read the procedure and what the videos at youtube to better assist you. I dont have the procedure for windows pc, I do have the macbook, but I believe the installation process should be the same.

0 Karma


Thank you for the response @ivanreis. I will do that as soon as I knock off and update

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...