Configuring Eventgen

We are almost there. Proceed by first downloading the exercise materials that will be used in this book. Open an administrator Command Prompt and make sure you are in the root of the Windows machine or Linux user shell. Download the ZIP file and extract it in your computer using https://github.com/PacktPublishing/Splunk-7-Essentials-Third-Edition.

The Eventgen configuration you will need for the exercises in this book has been packaged and is ready to go. We are not going into the details of how to configure Eventgen. If you are interested in learning more about Eventgen, visit the project page at http://github.com/splunk/eventgen.

Follow these instructions to proceed:

1. Extract the project ZIP file into your local machine. Open an administrator console and use the change directory command to set where you extracted the file.
2. Create a new samples directory in the Destinations Splunk app. The path of this new directory will be $SPLUNK_HOME/etc/apps/destinations/samples:

Windows:C:> mkdir C:\Splunk\etc\apps\destinations\samples
Linux:mkdir /splunk/etc/apps/destinations/samples

3. Copy all the *.sample files from /labs/chapter01/eventgen of the extracted project directory into the newly created samples directory. Windows users can also copy and paste using a GUI:

Windows:C:> copy C:\splunk-essentials-         master\labs\chapter01\eventgen*.sample 
         C:\Splunk\etc\apps\destinations\samples
Linux: cp /splunk-essentials-
       master/labs/chapter01/eventgen/*.sample                                                 /splunk/etc/apps/destinations/samples 

4. Now, copy the eventgen.conf into the $SPLUNK_HOME/etc/apps/destinations/local directory. Windows users can also copy and paste using the GUI if you prefer:

Windows: C:> copy C:\splunk-essentials-master\labs\     
        chapter01\eventgen\eventgen.conf 
           C:\Splunk\etc\apps\destinations\local
Linux:cp /splunk-essentials-master/labs/chapter01/eventgen.conf                      /splunk/etc/apps/destinations/local

5. Grant the SYSTEM Windows account full access permissions to the eventgen.conf file. This is a very important step. You can either do it using the following icacls command or change it using the Windows GUI. This step (Step 5) is not required for Linux users, who can move on to Step 6:

C:> icacls C:\Splunk\etc\apps\destinations\local\eventgen.conf 
           /grant SYSTEM:F

A successful output of this command will look like this:

processed file: C:\Splunk\etc\apps\destinations\local\eventgen.confSuccessfully processed 1 files; Failed processing 0 files

6. Restart Splunk.