Hello! I hope you can help! I have installed splunk enterprise 8.12 on my MAC OS 14.6.1 to study for an exam. Splunk installed fine. However the lab asked me to create an app called "destinations" which i did and i set the proper permissions. However, when i go to the app in the search head and type "index=main" it sees it but doesn't display any records. I have copied down eventgen to the samples folder in Destinations folder in the samples folder and copied the eventgen.conf to the local folder as directed but it still does not display.
I also see that the main index is enabled in indexes using theb $SPLUNK_DB/defaultdb/db
it also shows that it indexed 1mg out of 500gb.
I have a feeling that its something obvious but im not seeing it.
I really need this lab to work can you assist? I used SPLK-10012.PDF instructions. not sure if you have access to that. i pulled down the files fro github - eventgen.
Maybe this is an easy fix?
Thank you
