Skip to main content

This documentation does not apply to the most recent version of uberAgent. Click here for the latest version.

Demoing uberAgent With the Event Generator for Splunk

The uberAgent event generator is a tool for product demos that simulates an RDSH site with 5 active servers and 10 user sessions each.

Architecture

Starting with version 6.0, the Splunk event generator dependency was removed and uberAgent event generator is now a single Splunk app. When Splunk is started, a .NET Core program generates sample data. By default, sample data for two hours is generated. If you want to generate additional sample data, you can either restart the Splunk service after 2 hours or modify the uAEventGen.conf file (see section “Advanced configuration”).

The event generator Splunk app can be used on Windows, Linux, and on macOS-based Splunk installations. Both single server setups and distributed deployments are fully supported. The standard installation sends the data to a local Splunk instance using the TCP port 19500 which is opened by the uberAgent indexer Splunk app.

Requirements

The event generator Splunk app has the following requirements:

  • .NET Core 3.1 or newer
  • uberAgent indexer & dashboard Splunk apps

Installation

.NET Core

As of version 6.0, .NET Core is a prerequisite that must be installed on the same server where Splunk is installed. In the case of a distributed environment, .NET Core must be installed on the same Splunk indexers where you want to install the uberAgent event generator Splunk app.

You can download .NET Core here.

uberAgent Indexer & Dashboard Splunk Apps

Please follow the installation instructions for these apps.

uberAgent Event Generator

Install the uberAgent event generator on one of the indexers. If you have a single Splunk server, install the event generator on that server.

  • Download the uberAgent event generator (find out what’s new in the changelog)
  • On the Splunk server navigate to Manage apps
  • Click Install app from file
  • Select the archive you downloaded earlier and click Upload
  • Restart Splunk

That’s it. The event generator starts generating events right after Splunk has been restarted. It will continue to do so for approximately 2 hours and then stop on its own. Just what you need for a demo. To re-enable restart Splunk again.

Configuration

Enabling or Disabling the Event Generator

To enable or disable the uberAgent event generator:

  1. On the Splunk server where the uberAgent event generator app is installed navigate to Manage apps
  2. Locate the uberAgent event generator app and click on enable or disable
  3. Restart Splunk

Advanced Configuration

The default configuration should work for a single instance Splunk environment. If you have a distributed Splunk environment or you want to generate different generated sample data, you can
modify the configuration file uAEventGen.conf which is located $SPLUNK_HOME/etc/apps/uberAgent_eventgenerator/bin/uAEventGenBinaries/<your platform>.
The file contains full documentation of all possible configuration options.

Comments

Your email address will not be published. Required fields are marked *