A Splunk add-on extends and enhances the base functionality of Splunk. An add-on typically enriches data using prebuilt rules for a specific source to enable faster analysis. In this section, you will be installing your first add-on, called Splunk Eventgen, which will help us pre-populate Splunk with real-time simulated web data:

1. Download the ZIP file from the Eventgen public repository, http://github.com/splunk/eventgen. Click on the green Clone or download button. For Linux users, we've placed a copy of the Eventgen files used in this book at our download site: https://github.com/PacktPublishing/Splunk-7-Essentials-Third-Edition.
2. Extract the ZIP file to the root location for your environment.
3. Rename the extracted folder to SA-Eventgen. In Windows, this can be done with the Windows GUI, or via the mv command in Linux.
4. Open an administrator Command Prompt or Linux shell and execute the following command (the slashes are important):

Windows: C:> xcopy SA-Eventgen C:SplunketcappsSA-Eventgen /O /X /E /H /K
Linux: mv SA-Eventgen /$SPLUNK_HOME/etc/apps/

5. In the prompt, type the following directory command to verify that the copy works properly and the contents are in the folder:

Windows: C:> dir C:SplunketcappsSA-Eventgen
Linux: ls -l /$SPLUNK_HOME/etc/apps/

These are the contents of the recently copied SA-Eventgen folder, as shown in the following (Windows) screenshot, the same as what would appear in the similar location on Linux:

6. Return to the Splunk interface in your web browser and restart Splunk by selecting the Settings dropdown; under the SYSTEM section, click on Server controls:

7. On the Server controls page, click on the Restart Splunk button. Click on OK when asked to confirm the restart.
8. The web interface will first notify you that Splunk is restarting in the background, then it will tell you that the restart has been successful. Every time Splunk is restarted, you will be prompted to log in with your credentials. Go ahead and log in.
9. After logging in, you will now see the Eventgen app in the Splunk Enterprise landing page. Go to the Manage Apps page and confirm that the SA-EventGen application is installed:

You have successfully installed a Splunk add-on.