[dd-Splunk]

What

Three changes to the S4R stack, in one commit.

1. Eventgen at about 300 events/min

• Each stanza now emits its batch every 10 s instead of every 1 s. The baseline goes from about 3,000 to about 300 events/min and the attack stream from about 1,500 to about 150. The batch sizes are unchanged, so the product/cart ratio and the attack-to-baseline ratio stay the same.

2. The host is set in Eventgen

• host = www.buttercupenterprises.com is set in eventgen.conf [global] and inherited by every sample stanza. This replaces the index-time host transform from Make SA-S4R access_combined data CIM Web ready #38.
• Correction: that transform was built on a wrong conclusion. My earlier test of Eventgen's host setting copied the file into the running app without reloading Eventgen's config in splunkd, so the old value kept being used and I wrongly concluded that Eventgen ignores host. With the reload it works, per stanza and from [global]. The transform, its props stanzas and the wrong claim in the docs are removed, and changing the host no longer needs a Splunk restart.
• The docs now say that a hand-edited eventgen.conf on a running stack needs POST …/configs/conf-eventgen/_reload, then a disable and enable of the modinput.

3. The CIM app is no longer installed

• compose.yml, the pin table, the app lists and the specs drop Splunkbase 1621, which the workshop doesn't need.
• The CIM-compliant field names, the s4r_web_access eventtype with its web tag, and the exports stay. Anyone who installs the CIM app still gets a working Web model on this data. The docs say the stack doesn't install it.
• tests/s4r-cim-web.sh now fails if the Splunkbase pin comes back.

Version: SA-S4R goes 2.0.0 to 2.0.1. The rate and the host add no new interface, so it is a patch.

(An earlier version of this branch also added a small data model. I dropped it as out of scope for the workshop, and none of it is in this diff.)

Testing

On the running stack:

• After a conf reload and a modinput restart, Eventgen runs at about 55 events per 10 s. With the old transform unloaded (restart), events still carry host=www.buttercupenterprises.com from Eventgen alone.
• Eventgen's host works per stanza and inherited from [global], checked with a throwaway stanza writing to the empty summary index.
• CIM app disabled and so1 restarted: the Web model is gone, and the S4R tools, the host and tag, the CIM-named fields, the tool policies, make status and make verify-mcp-remote all still work.
• I deliberately broke tests/s4r-cim-web.sh three ways (host removed, transform back, CIM pin back) and each one fails.
• make check-splunkbase-pins, 384 relative Markdown links resolve, pre-commit run --all-files, make test

After merge: package-s4r.yml publishes 2.0.1 as latest. A new stack gets it, and no longer gets the CIM app, after make clean-y && make up. I have not run that fresh boot, because the packaged app only exists after merge.

🤖 Generated with Claude Code