Do we have sample data for Splunk Enterprise security app ?

[vikas_gopal]

Hi Experts,

I have Splunk ES app, do we have any sample data which I can feed and present it using ES app. Please suggest any other alternative if we do not have sample data .Right now all the dashboards and panels are empty . I am aware that this app uses data models to show data , I am afraid i am not aware that how i can insert data using these models.

Thanks
Vikas

[mcronkrite_splu]

You can also use the ES Sandbox to check out what data populates ES. It's quick free and easy.
http://blogs.splunk.com/tag/es-sandbox/ ,Also you can sign up for a Sandbox instance that has data flowing. It's great because you don't have to wait for data or configure eventgen. http://blogs.splunk.com/tag/es-sandbox/

[vikas_gopal]

Thanks for the quick response , so once I generate sample logs can I directly feed them to ES app or still they need some configuration ?

[mdessus_splunk]

If the data has an TA that is CIM compliant, it will feed directly in ES (you can see in Splunk base if an app is CIM compliant or not). Otherwise, you will have to normalize the data by yourself.

[mdessus_splunk]

Hello,

As said before, the datagen, with some apps that contains samples will automatically generate data that will feed the datamodel.

Otherwise, you can also try the demo sandbox here: https://www.splunk.com/getsplunk/es_sandbox .

[Splunker]

Hi Vikas,

Sure, the Splunk EventGen (Event Generator) app https://splunkbase.splunk.com/app/1924/ can generate logs to light up ES dashboards.

Not sure if it'll work with Splunk Cloud (not sure if you have ES on-prem or in Splunk Cloud), but EventGen is the app to generate dummy logs to allow you to explore ES.

Hope it helps!