How to do it...

Follow these steps to load the sample data generator on your system:

Log in to your Splunk server using your credentials.
From the Apps menu in the upper left-hand corner of the home screen, click on the gear icon.

The Apps settings page will load. Then, click on the Install app from file button:

Select the location of the OpsDataGen.spl file on your computer and then click on the Upload button to install the application:
After installation, a message should appear in a blue bar at the top of the screen, letting you know that the app has installed successfully. You should also now see the OpsDataGen app in the list of apps:
By default, the app installs with the data-generation scripts disabled. In order to generate data, you will need to enable either a Windows or Linux script, depending on your Splunk operating system. To enable the script, select the Settings menu from the top right-hand side of the screen and then select Data inputs:
From the Data inputs screen that follows, select Scripts.
On the Scripts screen, locate the OpsDataGen script for your operating system and click on Enable:
- For Linux, it will be $SPLUNK_HOME/etc/apps/OpsDataGen/bin/AppGen.path
- For Windows, it will be $SPLUNK_HOME/etc/appsOpsDataGen/bin/AppGen-win.path

The following screenshot displays both the Windows and Linux inputs that are available after installing the OpsDataGen app. It also displays where to click to enable the correct one based on the operating system Splunk is installed on:

Select the Settings menu from the top right-hand side of the screen, select Data inputs, and then select Files & directories.
On the Files & directories screen, locate the three OpsDataGen inputs for your operating system and for each click on Enable:
- For Linux, it will be $SPLUNK_HOME/etc/apps/OpsDataGen/data/access_log, $SPLUNK_HOME/etc/apps/OpsDataGen/data/app_log, and $SPLUNK_HOME/etc/apps/OpsDataGen/data/hvac_log
- For Windows, it will be $SPLUNK_HOME\etc\apps\OpsDataGendata\access_log, $SPLUNK_HOME\etc\apps\OpsDataGendata\app_log, and $SPLUNK_HOME\etc\apps\OpsDataGendata\hvac_log

The data will now be generated in real time. You can test this by navigating to the Splunk search screen and running the following search over an All time (real-time) time range:

index=main sourcetype=log4j OR sourcetype=access_combined

After a short while, you should see data from both the source types flowing into Splunk. The data generation is now working, as displayed in the following screenshot:

You can also test that the metric data is being generated by navigating to the Splunk search screen and running the following search over an All Time range:

| mcatalog values(_dims) WHERE index=hvac