Hi, I am new in Splunk Enterprise, I need your help to get the sample data uploaded on Splunk. I got the sample data from Splunk-7-Essentials-Third-Edition-master and it is inside the folder: C:\Splunk-7-Essentials-Third-Edition-master\Chapter01\eventgen If this the location of my app -> $SPLUNK_HOME\etc\apps\destination, and I have placed eventgen.conf inside the local, i.e. -> $SPLUNK_HOME\etc\apps\destination\local. The sample data is under new folder 'samples': $SPLUNK_HOME\etc\apps\destination\samples Now, this is what my eventgen.conf looks like: --------- # Note, these samples assume you're installed as an app or a symbolic link in # $SPLUNK_HOME/etc/apps/eventgen. If not, please change the paths below. # Modified by ericksond [destinations.sample] mode = sample sampletype = csv outputMode = splunkstream interval = 10 earliest = -10s latest = now count = 3 randomizeCount = 0.33 randomizeEvents = true token.0.token = ((\w+\s+\d+\s+\d{2}:\d{2}:\d{2}:\d{3})|(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}:\d{3})) token.0.replacementType = replaytimestamp token.0.replacement = ["%b %d %H:%M:%S:%f", "%Y-%m-%d %H:%M:%S:%f"] token.1.token = (5\.5\.5\.5) token.1.replacementType = file token.1.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/external_ips.sample token.2.token = (10\.2\.1\.35) token.2.replacementType = file token.2.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/webhosts.sample token.3.token = (Method-And-URI) token.3.replacementType = file token.3.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/destinations-uris.sample token.4.token = (User-Agent) token.4.replacementType = file token.4.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/useragents_desktop.sample token.5.token = (468) token.5.replacementType = random token.5.replacement = integer[100:1000] token.6.token = (1488) token.6.replacementType = random token.6.replacement = integer[200:4000]])" token.7.token = (200) token.7.replacementType = file token.7.replacement = $SPLUNK_HOME/etc/apps/destinations/samples/destinations-codes.sample ------------ After all these steps, i have restared the Splunk, could you possibly tell me where i am going wrong. Thanks in advance! @Penkov @harsmarvania57 @naidusadanala
... View more
