datagen

Synthetic demo data generators and ready-to-use datasets.

Available datasets

• datasets/servicenow - realistic synthetic ServiceNow incident, change, user, CMDB, and task-CI data for Splunk Enterprise Security demos.

Send CSV demo data to Splunk Cloud with HEC

Use send_csv_to_splunk.py to read CSV files from the output/ directory and send each row to Splunk HTTP Event Collector (HEC) as a JSON event. CSV columns are preserved inside the JSON event payload so Splunk can extract them as event fields.

Supported CSV files

CSV file in output/	Splunk index	Splunk sourcetype
auth.csv	demo_security	demo:auth
endpoint.csv	demo_security	demo:endpoint
dns.csv	demo_security	demo:dns
network.csv	demo_security	demo:network
web.csv	demo_security	demo:web
servicenow_incidents.csv	demo_servicenow	demo:snow:incident
servicenow_cmdb.csv	demo_servicenow	demo:snow:cmdb_ci
servicenow_changes.csv	demo_servicenow	demo:snow:change
servicenow_users.csv	demo_servicenow	demo:snow:user

The script parses the first available timestamp field from _time, time, timestamp, or opened_at and sends it as the Splunk HEC event time. The original CSV timestamp field remains in the JSON event.

Splunk Cloud setup

1. In Splunk Cloud, create or confirm the target indexes:

   • demo_security
   • demo_servicenow

2. Enable or create an HTTP Event Collector token with permission to write to those indexes.

3. Confirm your HEC endpoint. Splunk Cloud HEC URLs usually look like:

   https://http-inputs-<stack>.splunkcloud.com/services/collector/event
   

4. Export the HEC URL and token in your shell. Do not commit these values.

   export SPLUNK_HEC_URL="https://http-inputs-<stack>.splunkcloud.com/services/collector/event"
   export SPLUNK_HEC_TOKEN="<your-hec-token>"

Run

Dry-run first to validate CSV headers, timestamp parsing, and file mapping without sending data:

python3 send_csv_to_splunk.py --dry-run

Send all supported CSV files that exist in output/:

python3 send_csv_to_splunk.py

Fail if any expected CSV is missing:

python3 send_csv_to_splunk.py --require-all

Use a different CSV output directory:

python3 send_csv_to_splunk.py --output-dir /path/to/output

Validation SPL

Confirm data arrived by index and sourcetype:

index IN (demo_security, demo_servicenow)
| stats count earliest(_time) as earliest latest(_time) as latest by index sourcetype
| convert ctime(earliest) ctime(latest)
| sort index sourcetype

Validate ServiceNow incident fields:

index=demo_servicenow sourcetype=demo:snow:incident
| table _time number priority severity status assignment_group cmdb_ci business_service u_splunk_notable_event_id
| sort - _time

Validate CMDB fields:

index=demo_servicenow sourcetype=demo:snow:cmdb_ci
| table _time name dest dest_ip ip mac nt_host owner business_service u_criticality

Validate security telemetry sourcetypes:

index=demo_security sourcetype IN (demo:auth, demo:endpoint, demo:dns, demo:network, demo:web)
| stats count by sourcetype