Splunk Eventgen

hnguyen41 · ‎10-18-2018

I am new to Splunk. I tried to install SA_Eventgen app. When I went to apps directory (/opt/slunk/etc/apps/SA_Eventgen/local), I get permission denied. Can anyone explained it to me please? I could not find the tutorial video for the eventgen app either, if someone know where can I find a tutorial session?

Thank a lot.

ehollima · ‎10-18-2018

Appendix B: Eventgen troubleshooting tips:
http://dev.splunk.com/view/dev-guide/SP-CAAAE3E

hnguyen41 · ‎10-18-2018

Do you know why I am not allowed to access the local directory for that app?

ehollima · ‎10-18-2018

Here are 2 resources to help you:
I use this one, it is straight forward and works with any TA that has eventgen files:
https://github.com/coccyx/eventgen

Recent find I am investigating:
https://github.com/splunk/eventgen

Splunk Eventgen

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

Splunk Eventgen

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security