All Apps and Add-ons

Splunk EventGen not working on Windows 10

masambaghost
Explorer

Good Day Team,

Did anyone manage to get splunk eventgen working on windows 10?
I have been struggling to get it working on my windows 10 PC using splunk v7.3.2. I want to GIT but didnt get much that I understood could help.
I just wanted to follow through on some practical exercises I was setting up.

Regards,

Tags (1)
0 Karma

ivanreis
Builder

please read this link -> https://answers.splunk.com/answers/656711/how-to-install-splunk-eventgen-in-a-windows-enviro.html

Here is the step I took to deploy eventgen to my macbook.

  1. Deployed the eventgen at Splunk
  2. Deployed the Splunk_TA_Windows version 4.8.4 This version has a evengen.conf file at default folder
  3. Create a local folder at evengen app
  4. Copy the eventgen.conf from Splunk_TA_Windows app to eventgen local folder

the key to have your eventgen working properly is to extract the correct data using token.

See below a sample configuration for Windows data.

Use Splunk_TA_Windows/default/inputs.conf sequence

Default replacement for all DhcpSrvLog logs

[sample.DhcpSrvLog]
index = windows
source=c:\windows\system32\dhcp\dhcpsrvlog.log
sourcetype = DhcpSrvLog
interval = 300

Generate all events in sample

count = 0
earliest = -5m
latest = now

replace timestamp 10,07/21/06,19:42:47

token.0.token = ^\d+\,(\d{2}\/\d{2}\/\d{2}\,\d{2}:\d{2}:\d{2})
token.0.replacementType = timestamp
token.0.replacement = %m/%d/%y,%H:%M:%S

0 Karma

masambaghost
Explorer

Hello,

Thank you for the prompt response:
Firstly, I tried out this link and installed it as an app but when I run a search string (index=main) I get nothing.
I was following the steps in the book Splunk 7 Essentials religiously but to no avail.

I just want a step by step procedure on installing on a Windows 10 PC.

0 Karma

ivanreis
Builder

you have to check if this data was send to other index into splunk.

Please troubleshoot the issue, check the internal index to identify which error messages you are getting. Read the procedure and what the videos at youtube to better assist you. I dont have the procedure for windows pc, I do have the macbook, but I believe the installation process should be the same.

0 Karma

masambaghost
Explorer

Thank you for the response @ivanreis. I will do that as soon as I knock off and update

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...