Eventgen Manager

The Eventgen Manager app provides a browser-based configuration interface for SA-Eventgen, the standard Splunk utility for generating realistic test and demonstration data. SA-Eventgen generates events from sample files using powerful configuration directives defined in eventgen.conf, supporting interval-based replay, token substitution, rate curves, and multiple output modes including indexing, HTTP Event Collector, and syslog. Eventgen Manager eliminates the need to hand-edit configuration files by providing a guided editor that exposes every SA-Eventgen setting through labeled form fields. The app includes a live preview feature that renders generated events in the browser without indexing them, allowing administrators to validate token replacements, timestamps, and event structure before activating a configuration. Rate curves for hour-of-day and day-of-week event distribution are edited as numeric values per time bucket rather than raw JSON arrays. The app also provides sample file management capabilities, allowing users to upload, review, and delete sample files directly from the browser without requiring shell access to the Splunk server. Generator control features include the ability to start and stop the SA-Eventgen modular input, view configuration status, and monitor throughput metrics from the _internal index. The app requires the SA-Eventgen add-on to be installed on the same Splunk instance and requires admin or sc_admin role privileges to create or modify configurations.