We have created our own Eventgen app which holds sample data and the `eventgen.conf` file. Looking at Splunk's Eventgen [documentation][1], is it not entirely clear where such an app needs to reside in a distributed deployment with multiple clustered search heads and indexers.
From our testing it looks like any one indexer would be the correct choice, however we would like to get confirmation on that.
FYI, we are planning to deploy our eventgen app in a mode that does not require Splunk authentication, ie. by setting `splunkHost` to `localhost`.
Note: this question is about version 4 of [Splunk's Eventgen][2].
[1]: https://github.com/splunk/eventgen/tree/develop/README
[2]: https://github.com/splunk/eventgen/
↧