Machine data is the information produced by the many functions carried out by computers and other mechanical machines. If you work in an environment that is rich in machine data, you will most likely have many sources of readily-available machine inputs for Splunk. However, to facilitate learning in this book, we will use a Splunk add-on called the Splunk Eventgen to easily build real-time and randomized web log data. This is the type of data that would be produced by a web-based e-commerce company.
Note
If you need more detailed information about Eventgen, you can follow the project's GitHub repository at https://github.com/splunk/eventgen/.
Here's an important tip. Make it a habit to always launch your command prompt in Administrator mode. This allows you to use commands that are unhindered by Windows security:
Right-click on the Windows Start menu icon and select Search. In Windows 7, you can click on the Windows icon and the search window will be directly above it. In Windows 10, there is a search bar named Cortana next to the Windows icon that you can type into. They both have the same underlying function.
In the search bar, type
cmd.In the search results, look for
command.exe(Windows 7) or a command prompt (Windows 10), right-click on it, then select Run as administrator.
A Splunk add-on extends and enhances the base functionality of Splunk. They also typically enrich data from source for easier analysis. In this section, you will be installing your first add-on called Splunk Eventgen that will help us pre-populate Splunk with real-time simulated web data:
First we need to install the Eventgen add-on. If you have Git (https://git-scm.com) installed on your machine, you may clone the entire project onto your machine with the following command:
C:\> git clone https://github.com/splunk/eventgen.gitYou may also download the ZIP file from the Eventgen's public repository, http://github.com/splunk/eventgen, and extract it onto your machine. The download ZIP button is in the lower-right corner of the GitHub repository page.
After extracting the ZIP file, copy the entire
eventgendirectory into the$SPLUNK_HOME/etc/apps/folder. You may need to rename it fromeventgen-mastertoSA-EventGenif you manually downloaded the ZIP file. The trailing slashes are important. Now open an administrator command prompt and execute the following command:C:\> xcopy eventgen c:\Splunk\etc\apps\SA-Eventgen /O /X /E /H /KIn the prompt, type D. Verify the contents of the folder using the following command:
C:\> dir c:\Splunk\etc\apps\SA-EventgenThese are the contents of the recently-copied
SA-Eventgenfolder as shown in the following screenshot:
Restart Splunk by selecting the Settings dropdown, and under the SYSTEM section, click on Server controls:
On the Server controls page, click on the Restart Splunk button as shown in the following screenshot. Click OK when asked to confirm the restart:
The web interface will first notify you that Splunk is restarting in the background, then it will tell you that the restart has been successful. Every time Splunk is restarted, you will be prompted to log in with your credentials. Go ahead and log in.
Go to the Manage Apps page and confirm that the
SA-EventGenapplication is installed:
You have successfully installed a Splunk add-on.