SA-Eventgen is not generate event

[leeyounsoo]

Hi, Splunk.
I have a question about SA-Eventgen.

I installed the Splunk Enterprise Security app and the SA-Eventgen app, and I want to create dashboards with randomly generated event data. (Data from TA apps that are installed automatically during ES installation)

Once installed, some data is generated, but once every two days, once every three days, no data is generated for an instant.

I erased the SA-Eventgen app and tried reinstalling it, but the results were the same.

What should I do?

[kamlesh_vaghela]

@leeyounsoo

Can you please check Splunk App Installation / First Run section from http://splunk.github.io/eventgen/SETUP.html#install . I think you have to enable SA Eventgen Data Input.

If SA-Eventgen App is correctly installed, there is no additional configuration required. SA-Eventgen app will automatically identify with any apps with eventgen.conf.

To start generating data, simply enable the SA-Eventgen modinput by going to Settings > Data Inputs > SA-Eventgen and by clicking “enable” on the default modular input stanza.

[hijacob]

Do you know Gogen? On GitHub you can get more information https://github.com/coccyx/gogen

Best wishes,
Jacob

[leeyounsoo]

It was installed and activated by clicking the enable button.
But it is not being collected today.

Splunk just collecting this data

==== sourcetype =======
Perfmon:CPU
PerfmonMk:CPU
PerfmonMk:LogicalDisk
.......
modular_alerts:notable
modular_alerts:risk
nessus
protocol
ps

......

but, i need this data
==== sourcetype =======
bluecoat:proxysg:access:file
bluecoat:proxysg:access:syslog
......
sophos:computerdata
sophos:devicecontrol
sophos:firewall

......

[inventsekar]

Once installed, some data is generated, but once every two days, once every three days, no data is generated for an instant
Please update us some more details -
How Eventgen app was configured? did you try some sample templates from the Eventgen app?