Build a Security Log Dashboard

Ingest web server logs into Splunk and build an interactive SIEM dashboard.

Introduction

30 Second Summary

Every website generates thousands of log entries recording who visited, what they clicked, and whether something went wrong. Without a way to search and visualize this data, important patterns stay buried in walls of text.

In this project, you will build an interactive analytics dashboard in Splunk Cloud Platform that turns raw web server logs into visual insights. You will learn how to ingest data, write search queries, and create charts that reveal purchase trends and error patterns at a glance.

What You'll Build

You will build a multi-panel dashboard in Splunk Cloud Platform that visualizes web access log data from a fictional online store using pie charts, bar charts, and time series panels.

By the end of this project, you'll have:

  • A Splunk Cloud Platform trial instance with indexed web server log data ready for searching.
  • Multiple SPL queries that extract insights like top purchases, error rates, and traffic trends from raw machine data.
  • A multi-panel interactive dashboard with visualizations and a shared time picker that controls all panels.
  • Secret Mission: An automated alert that fires when error rates spike above a threshold.

Are there any prerequisites?

None. This project is designed for absolute beginners with no prior Splunk or SIEM experience. Everything runs in your browser using a free 14-day trial that requires no credit card.

Sign Up for Splunk Cloud Platform

Before you can analyze any security logs, you need a platform that can ingest and search through them. Splunk Cloud Platform is an industry-standard tool for exactly this.

In this step, you will create a free Splunk Cloud Platform trial account and access your personal cloud instance. No credit card is required, and everything runs in your browser.

In this step, get ready to:
  • Create a Splunk Cloud Platform trial account.
  • Access your personal Splunk instance in the cloud.
  • Confirm you can see Splunk Home in your browser.
Create your Splunk account

Splunk offers a 14-day free trial of their cloud platform. You will sign up directly on their website.

  • In your web browser, navigate to the Splunk Cloud Platform trial page.
  • Scroll down to the sign-up form on the page.
  • Fill in the Business Email field with your email address.
  • Create a Password for your Splunk account.
  • Enter your First Name and Last Name.
  • Fill in the remaining required fields (Job Title, Phone Number, Company, and Zip / Postal Code).
  • Check the box to agree to the Splunk terms and conditions.
  • Click Create your account.

No credit card needed

This trial is completely free for 14 days with 5 GB/day of data ingestion. You will not be charged anything, and the trial cannot be converted to a paid account.

When the trial expires, the instance and all data in it is automatically deleted by Splunk.

Already have a Splunk account?

If you already have an account, click Login at the top of the page instead of creating a new one. You can start a Cloud Platform trial from an existing account.

help me sign up for or log into Splunk Cloud Platform

Access your Splunk instance

After creating your account, Splunk provisions a cloud instance for you. A confirmation page guides you through the final activation steps.

  • On the confirmation page, click View My Instance.
  • Complete the CAPTCHA to confirm you are not a robot.
  • Click Start Trial.
  • Accept the Terms of Service.

Splunk Cloud Platform opens in your browser. You are now signed into Splunk Web and should see the Splunk Home page.

What is your instance URL?

Your personal instance URL looks like https://prd-p-xxxxx.cloud.splunk.com where xxxxx is unique to you. Bookmark this URL so you can return to it later.

You will also receive an email with your instance URL and login credentials. The default username is sc_admin.

Instance not ready yet?

Your cloud instance can take a few minutes to provision. If the confirmation page does not appear immediately after sign-up, wait and refresh the page.

Check your email (including spam folder) for a message from Splunk with your instance URL and credentials.

help me access my Splunk Cloud Platform trial instance

Understand what you just got

You now have a fully functional SIEM platform running in the cloud. Take a moment to understand what that means.

What is a SIEM?

SIEM stands for Security Information and Event Management. It is a category of software that ingests machine data (like server logs), indexes it for fast searching, and lets you visualize patterns.

Splunk is one of the most widely used SIEM platforms in the industry. Security Operations Centers (SOCs) use it to detect threats, investigate incidents, and monitor infrastructure health.

What does your trial include?

Your Splunk Cloud Platform trial gives you 5 GB per day of data ingestion for 14 days. It runs entirely in your browser with no software to install on your machine.

The trial includes all the features you need for this project: data ingestion, SPL searching, dashboards, visualizations, and alerts.

  • Confirm that you can see the Splunk Home page in your browser.
  • You should see the Apps panel on the left, the Splunk bar at the top, and the Explore Splunk panel in the center.

Close the welcome window

If you see a window inviting you to drop your data file, close it. You will upload data in a later step using a different method.

Your Splunk Cloud Platform instance is ready to go. Next up, you will explore the Splunk interface and learn how to navigate its key areas before ingesting any data.

Explore the Splunk Interface

Your Splunk Cloud Platform trial is up and running. Now it's time to learn where everything lives in the interface before you start working with real data.

Splunk's interface is organized around apps, a top navigation bar, and search tools. Getting familiar with this layout now saves time when you're building queries and dashboards in later steps.

In this step, get ready to:
  • Tour Splunk Home and identify its main panels.
  • Open the Search & Reporting app.
  • Locate the Settings menu for future data ingestion.
Tour Splunk Home

Splunk Home is the landing page you see when you log in. It has three main areas you should know about before diving into searches.

  • Look at the left side of the screen. This is the Apps panel. It lists all installed apps on your Splunk instance.
  • Look at the top of the screen. This is the Splunk bar. You use it to navigate between apps and access settings.
  • Look at the center of the screen. This is the Explore Splunk panel. It provides quick links to help you get started.

What are these three areas for?

The Apps panel is like a menu of tools. Each app bundles a set of features together. The default pinned app is Search & Reporting, which is where you'll spend most of your time.

The Splunk bar stays visible no matter which app you're in. Think of it as your global navigation. The Explore Splunk panel gives you starting points like adding data or reading docs.

Open the Search app

The Search & Reporting app is where you write queries, explore data, and build visualizations. Let's open it and identify the key components.

  • Click Search & Reporting in the Apps panel on the left side.
  • Look at the top of the page. The Search bar is where you type SPL queries to ask questions of your data.
  • Look to the right of the Search bar. The time range picker controls which time window your searches cover.
  • Look below the Search bar. The result tabs are Events, Patterns, Statistics, and Visualization. These display your search results in different formats.

What is SPL?

SPL stands for Search Processing Language. It's the query language you use to search, filter, and transform data inside Splunk. You'll write your first SPL query in a later step.

Why four result tabs?

Each tab shows the same search results in a different way. Events shows raw log lines. Patterns groups similar events together.

Statistics displays results as a table (used with commands like top and stats). Visualization turns table results into charts and graphs.

Explore Settings

The Settings menu is where you manage data inputs, indexes, and system configuration. You'll use it in the next step to upload log data.

  • Click Settings in the Splunk bar at the top of the screen.
  • Look for Add Data in the menu that appears. This is the entry point for uploading data into Splunk.
  • Click Search & Reporting in the Apps bar to return to the Search app.

What is data ingestion?

Data ingestion is the process of getting raw data (like log files) into Splunk so it can be searched. Splunk takes your data, breaks it into individual events, timestamps each one, and stores them in an index. Once indexed, you can search millions of events in seconds.

Remember the path

The path Settings > Add Data > Upload is what you'll follow in the next step to get log data into your instance.

You now know your way around Splunk's interface. Next up, you'll download real log data and upload it into your instance so you have something to search.

Download and Ingest Log Data

Your Splunk instance is running, but it has no data to search yet.

In this step, you will download a sample log dataset and upload it into Splunk for indexing. Once indexed, the raw log lines become searchable events that you can query and visualize.

In this step, get ready to:
  • Download the tutorial data file to your computer.
  • Upload the data into Splunk using the Add Data wizard.
  • Verify that events are indexed and searchable.
Download the tutorial data

Splunk provides an official sample dataset called tutorialdata.zip. It contains web access logs, secure logs, and vendor sales data from a fictional online store called Buttercup Games.

Is your file unzipped?

Some browsers (especially Safari) automatically extract ZIP files after downloading. If you see a folder called tutorialdata instead of tutorialdata.zip, the file was auto-extracted.

To fix this in Safari:

  • Open Preferences, then select General.
  • Uncheck Open "safe" files after downloading.
  • Re-download the file from the tutorial page.

What is in this data?

The tutorial data simulates logs from an online store. It includes three types of log files:

  • Web access logs (HTTP requests, status codes, URLs visited).
  • Secure logs (SSH login attempts and session activity).
  • Vendor sales logs (transactions with vendor IDs and account codes).

The data is refreshed daily and contains timestamped events for the previous seven days.

Upload the data to Splunk

Now you will feed the log data into Splunk using the Add Data wizard. This process is called data ingestion. Splunk reads the raw file, splits it into individual events, and stores them in an index for fast searching.

  • Switch back to your Splunk Web browser tab.
  • Click Settings in the Splunk bar at the top of the page.
  • Click Add Data.
  • Click Upload at the bottom of the page.
  • Click Select File.
  • Navigate to your Downloads folder and select tutorialdata.zip. Click Open.
  • Click Next to continue to Input Settings.

Why did Splunk skip a step?

When you upload a ZIP file, Splunk automatically recognizes the compressed data source. It skips the Set Source Type configuration step because Splunk determines the format of each file inside the ZIP on its own.

  • On the Input Settings page, find the Host section.
  • Select Segment in path.
  • Type 1 for the segment number.
  • Click Review.
  • Review your settings, then click Submit.

What does the Host setting do?

The Host field labels each event with the machine it came from. By selecting Segment in path with segment 1, you tell Splunk to use the first directory name in the file path as the host value.

This means events from different subdirectories in the ZIP get different host labels. In production, this helps you trace which server generated each log line.

Verify your data is indexed

After a successful upload, Splunk gives you the option to start searching your newly indexed data immediately.

  • Click Start Searching.

Splunk opens the Search app and automatically runs a search on your uploaded data. You should see a list of events with timestamps appearing below the search bar.

Not seeing any results?

If your search returns zero events, the time range picker might be set too narrowly. The tutorial data contains events timestamped for the previous seven days, so a narrow time window might miss them.

  • Click the time range picker in the top right of the Search bar.
  • Select All time.
  • Press Enter or click the search button to re-run the search.

Help me troubleshoot missing search results in Splunk

  • Set the time range picker to All time to confirm all your data is present.

You should now see events listed with timestamps, source files, and raw log text. Each row is one log event from the tutorial data. You have real machine data inside Splunk, ready to query.

Your data is indexed and searchable. Next up, you will dig into individual events and learn how Splunk parses raw log lines into structured fields.

Read and Understand Raw Events

Your tutorial data is now indexed and ready to explore. Before you can ask questions of your data, you need to understand what a single log event looks like and how Splunk breaks it into searchable pieces.

In this step, you will open individual events, learn how Splunk automatically extracts fields from raw log text, and filter your data by sourcetype.

In this step, get ready to:
  • Examine a single raw log event and identify its components.
  • Explore the Fields sidebar to understand Selected Fields and Interesting Fields.
  • Filter your search results by sourcetype.
Examine an event

Each row in your search results is one log event. To build useful queries later, you first need to understand what information lives inside a single event.

  • In your search results, click on any single event row to expand it.

Splunk shows you two things: the raw text of the log line on the right, and extracted fields on the left.

What does a web access log event contain?

A web access log event follows a standard format. Reading left to right, you will see an IP address (who made the request), a timestamp (when it happened), an HTTP method like GET or POST (what they did), a URL path (which page), and a status code like 200 or 404 (whether it worked).

Splunk automatically parses this raw text into named fields so you can search and filter by any individual piece of information.

  • Look at the raw event text. You should see an IP address, a timestamp in square brackets, an HTTP method, a URL, and a three-digit status code.

Don't see any events?

Make sure your time range picker (top right of the Search bar) is set to All time. The tutorial data may have timestamps outside the default range.

Help me see events in my Splunk search results.

Understand fields

Fields are how you ask precise questions of your data. Instead of scanning raw text line by line, you can search by specific field values like a status code or IP address.

  • Look at the Fields sidebar on the left side of the search results.
  • Notice the two sections: Selected Fields at the top and Interesting Fields below it.

What are Selected Fields and Interesting Fields?

Selected Fields are always shown for every event. These include host (which machine generated the log), source (which file or input the event came from), and sourcetype (the format of the data).

Interesting Fields are additional fields that Splunk discovered in your data. These include things like status, action, categoryId, and clientip. Splunk extracted these automatically from the raw log text.

  • Click on the field name status in the Interesting Fields section.

A popup appears showing the top values for that field and how many events contain each value. You can see at a glance which HTTP status codes appear most often in your data.

Why are field value counts useful?

Clicking a field name gives you an instant summary of what that field contains across all your events. For the status field, you can immediately see how many requests succeeded (200) versus how many failed (404, 500). This is faster than scanning thousands of raw log lines manually.

Understand sourcetypes

Your tutorial data contains multiple types of logs, all mixed together. The sourcetype field tells Splunk what format each event is in, so you can filter to just the type of data you care about.

  • Close the field popup if it is still open.
  • Look at the sourcetype field in the Selected Fields section. Your data has three sourcetypes:
  • Filter to just web access logs by typing the following query into the Search bar and pressing Enter:
sourcetype=access_combined_wcookie

Your search results now show only web access log events. Every event is a single HTTP request to the Buttercup Games website.

What does this query do?

The query sourcetype=access_combined_wcookie tells Splunk to find events where the sourcetype field equals access_combined_wcookie. This filters out the authentication logs and sales records, leaving only web server traffic.

This is the foundation of every SPL query you will write in the next steps. You start by narrowing down to the events you care about using field-value pairs.

Seeing zero results?

Double-check that your time range picker is still set to All time. Also confirm that you typed the sourcetype value exactly as access_combined_wcookie with no spaces or capital letters.

Why is my Splunk sourcetype search returning zero results?

You now know how to read a raw log event and use fields to slice your data. Next up, you will write SPL queries that combine fields and transforming commands to answer real questions about Buttercup Games purchases.

Write Your First SPL Queries

In the previous step, you learned how to read raw log events and how Splunk organizes data into fields. Now you are ready to ask specific questions of that data.

SPL (Search Processing Language) is the query language you type into the Search bar to filter, transform, and summarize events. In this step, you will write three queries that progressively build on each other to extract purchase insights from the Buttercup Games logs.

In this step, get ready to:
  • Filter events by keywords and field values.
  • Use the pipe character and the top command to rank field values.
  • Use the stats command to count purchases by category and visualize them as a bar chart.
Search by keywords and fields

SPL queries work by combining field-value pairs to filter down to exactly the events you want. Each pair acts like a filter that narrows your results.

  • In the Search bar in Search & Reporting, type the following query:
sourcetype=access_* status=200 action=purchase
  • Press Enter or click the green search button to run the query.
  • If no results appear, change the time range picker (top right of the Search bar) to All time and run the search again.

What does this query do?

This query uses three field-value pairs as filters:

  • sourcetype=access_* matches all web access log sourcetypes (the wildcard * means "anything that starts with access").
  • status=200 keeps only events where the HTTP status code was 200 (a successful request).
  • action=purchase keeps only events where the customer performed a purchase action.

SPL reads left to right. Splunk first finds all events matching your criteria. After a pipe (which you will add next), it can transform those results.

You should see a list of events in the Events tab. Each event represents a successful purchase from the Buttercup Games online store.

Seeing zero results?

  • Check that the time range picker is set to All time. The tutorial data has a fixed time range that may fall outside the default window.
  • Make sure there are no extra spaces around the = signs. SPL expects field=value with no spaces.
  • Verify you typed access_* with an underscore, not a hyphen.

Still stuck? Help me figure out why my SPL search returns no results.

Use the pipe and the top command

Filtering events is useful, but you need a way to summarize them. The pipe character (|) takes the results from the left side and feeds them into a transforming command on the right.

  • Replace your current search with the following query and run it:
sourcetype=access_* status=200 action=purchase | top categoryId
  • Click the Statistics tab (below the Search bar) to see your results as a table.

What does the top command do?

The top command counts the most common values of a field and ranks them from highest to lowest. It automatically calculates both the count and the percentage for each value.

In this case, top categoryId shows you which product categories have the most purchases. The pipe character feeds all your filtered purchase events into the top command so it can count them.

You should see a table with three columns: categoryId, count, and percent. Each row represents a product category ranked by how many purchases it received.

Seeing raw events instead of a table?

  • Make sure you clicked the Statistics tab. Transforming commands like top produce table output that only appears on that tab.
  • Check that you included the pipe character (|) between the search terms and the top command.

Need more help? Help me fix my SPL query with the top command.

Use the stats command

The stats command gives you more control over your aggregations than top. It lets you choose exactly which statistical function to apply (count, sum, avg, and more) and group results by any field.

  • Replace your current search with the following query and run it:
sourcetype=access_* status=200 action=purchase | stats count by categoryId
  • Click the Statistics tab to see the count per category.
  • Click the Visualization tab to see the results as a chart.
  • In the chart type selector, select Bar Chart to view your results as horizontal bars.

What does stats count by do?

The stats count by categoryId command counts the number of events for each unique value of categoryId. Think of it like asking: "How many purchases happened in each product category?"

Unlike top, the stats command does not automatically add a percentage column or sort by frequency. You get raw counts grouped by your chosen field, which gives you flexibility to apply additional transformations later.

You should see a bar chart where each bar represents a product category and its length shows the number of purchases. You are now querying log data like a professional analyst.

Bar chart not showing?

  • Make sure you are on the Visualization tab, not the Statistics tab. Statistics shows a table. Visualization shows the chart.
  • If you see a different chart type (like a line chart), click the chart type selector and choose Bar Chart from the options.

Still not working? Help me display my SPL stats results as a bar chart.

You have written three SPL queries that filter, rank, and count events from raw log data. Next up, you will learn to visualize trends over time using the timechart command.

Visualize Trends Over Time

You can now filter and count log data with SPL. That is powerful for answering specific questions, but it does not show you when things happen.

Spotting spikes, outages, and unusual patterns requires a time-based view of your data. In this step, you will use the timechart command to turn raw events into time-series visualizations that reveal traffic trends at a glance.

In this step, get ready to:
  • Build a time-series chart that shows traffic volume over time.
  • Break down traffic by HTTP status code to compare success and error rates.
  • Use the time range picker to zoom in on specific windows of activity.
Build a timechart

The timechart command groups events into time buckets and counts them. The result is a chart with time on the X-axis and event count on the Y-axis.

  • In the Search bar, enter the following query and click the green search button (or press Enter):
sourcetype=access_* | timechart count
  • Click the Visualization tab (next to the Statistics tab) to see the chart.

What does this query do?

The pipe (|) takes all web access log events and feeds them into timechart count. Splunk automatically divides the time range into buckets and counts how many events fall into each one.

The result is a line chart showing traffic volume over time. Tall spikes mean high activity. Dips mean quiet periods.

You should see a line chart with time across the bottom and event counts on the left axis. The shape of the line reveals when the Buttercup Games store was busiest.

Seeing a flat line or no data?

Change the time range picker (top right of the Search bar) to All time. The tutorial data covers a specific historical window, so a narrow time range like "Last 24 hours" may return nothing.

If the chart still looks empty, make sure your search uses sourcetype=access_* with no extra spaces or typos.

Help me troubleshoot my timechart query in Splunk.

Break down by HTTP status code

A total traffic count is useful, but you often need to see different categories of traffic separately. Adding a by clause to timechart splits the results into multiple lines, one per distinct value of the field you choose.

  • Clear the Search bar and enter this updated query:
sourcetype=access_* | timechart count by status
  • Click the Visualization tab to see the updated chart.

What changed?

Adding by status tells Splunk to create a separate line for each HTTP status code. You can now see when 200 responses (success), 404 responses (not found), and other codes occurred relative to each other.

This is how analysts spot error spikes in production. If the 404 line suddenly towers over the 200 line, something is broken.

You should see multiple colored lines, each representing a different status code. A legend at the top or side maps colors to codes.

  • Click the chart type selector (the icon showing chart styles, near the top of the Visualization tab).
  • Try Column Chart to see stacked bars for each time bucket.
  • Try Area Chart to see filled regions stacked on top of each other.
  • Switch back to Line Chart when you are done exploring.

Which chart type should I use?

Line charts work best for spotting trends and comparing rates of change. Column charts highlight volume at each point in time. Area charts show both volume and proportion when data is stacked.

There is no single correct choice. The best chart is the one that makes the story in your data easiest to read for your audience.

Only seeing one line?

Make sure your query ends with by status (not by sourcetype or another field). The status field contains HTTP response codes like 200 and 404.

Help me debug my timechart by status query.

Adjust the time range

The time range picker controls which events are included in your search results. Narrowing or expanding the window changes what your chart displays.

  • Locate the time range picker in the top right area of the Search bar.
  • Click it and select Last 7 days. Your chart updates to show only events from that window.
  • Click the time range picker again and try Last 24 hours.
  • Finally, click All time to return to the full dataset view.

Why does the time range matter?

In production monitoring, you use the time range picker to zoom into incidents. If an alert fires at 3:00 AM, you narrow the window to 2:00 AM through 4:00 AM to see exactly what happened before and after the spike.

The tutorial data covers a fixed historical period. If you select a window that does not overlap with that period (like "Last 24 hours" when the data is from months ago), you will see zero results. That is expected. Switch back to All time to see everything.

You can now visualize how traffic behaves over time and spot patterns that raw numbers alone would never reveal. Next up, you will save these visualizations into a permanent dashboard that you can share with your team.

Create Your First Dashboard

You've explored how SPL queries and visualizations reveal patterns hiding in your log data.

The challenge is that running searches every time you want to check on your data is not practical. In this step, you'll save your best queries as permanent dashboard panels that display at a glance without re-running searches manually.

In this step, get ready to:
  • Save a pie chart panel showing top product purchases.
  • Add a line chart panel showing web traffic over time.
Save a search as a dashboard panel

A dashboard is a collection of panels that display saved search results as visualizations. You can build one directly from a search you've already run.

  • In the Search bar, type the following query and press Enter:
sourcetype=access_* status=200 action=purchase | top categoryId
  • Click the Visualization tab to see your results as a chart.
  • Change the chart type to Pie Chart using the chart type selector.
  • Click Save As and choose Dashboard Panel.
  • For Dashboard, select New.
  • Set Dashboard Title to Buttercup Games - Purchases.
  • Set Panel Title to Top Purchases by Category.
  • Confirm Panel Content is set to Pie Chart.
  • Click Save.
  • Click View Dashboard.

What just happened?

You saved your SPL search as a permanent panel inside a brand new dashboard. The pie chart visualizes which product categories generate the most purchases from the Buttercup Games store.

Splunk stores both the query and the visualization type, so the panel re-runs the search and renders fresh results every time you open the dashboard.

Don't see the Save As option?

Make sure you ran the search first. The Save As button only becomes active after a search has produced results.

If you see no results at all, change the time range picker to All time and re-run.

Help me troubleshoot saving a dashboard panel in Splunk

View your dashboard

You now have a dashboard with one panel. The pie chart shows which product categories generate the most purchases at Buttercup Games.

Why dashboards matter in the real world

In a workplace, you would share this dashboard with your team to show product performance at a glance. Instead of re-running searches every morning, stakeholders open the dashboard and see live results immediately.

Add a second panel

A single-panel dashboard is useful, but real dashboards combine multiple views. You'll add a traffic-over-time panel so you can see both purchase breakdowns and overall traffic volume in one place.

  • Click Search & Reporting in the Apps bar to return to the Search app.
  • In the Search bar, type the following query and press Enter:
sourcetype=access_* | timechart count
  • Click the Visualization tab. You should see a line chart showing traffic volume over time.
  • Click Save As and choose Dashboard Panel.
  • For Dashboard, click Existing and select Buttercup Games - Purchases.
  • Set Panel Title to Web Traffic Over Time.
  • Keep the visualization as Line Chart.
  • Click Save.
  • Click View Dashboard.

Your dashboard now has two panels: a pie chart breaking down purchases by category, and a line chart showing overall web traffic over time.

What does the second panel show?

The timechart count query buckets all web access events by time. The resulting line chart lets you spot traffic spikes or quiet periods at a glance.

Together with the pie chart, you now have both a "what" view (which products sell) and a "when" view (when traffic happens).

Don't see both panels?

Make sure you selected Existing (not New) when saving the second panel. If you accidentally created a second dashboard, delete it and repeat the save step on the existing Buttercup Games - Purchases dashboard.

Help me fix my Splunk dashboard panels

Your dashboard already tells a story about Buttercup Games traffic and purchases. Next up, you'll add interactivity with a shared time picker that lets you control what time window all panels display at once.

Add Interactivity with a Time Picker

Your dashboard now has two panels showing purchase breakdowns and traffic volume. Each panel currently uses its own independent time range, which means you cannot zoom into the same time window across all your data at once.

A shared time picker lets you control the time window for every panel from a single input. In this step, you will add a third panel showing error codes, then wire all three panels to a shared time picker so they update together.

In this step, get ready to:
  • Add an error codes panel to the dashboard.
  • Add a shared time picker input to the dashboard.
  • Connect all three panels to the shared time picker.
Add a third panel to the dashboard

Before wiring up the time picker, you need one more panel. This panel will show how often different HTTP error codes appear in your logs.

  • Return to the Search & Reporting app by clicking Search & Reporting in the Apps bar at the top.
  • In the Search bar, type the following query and press Enter:
sourcetype=access_* status>=400 | stats count by status

What does this query do?

This query filters for events where the HTTP status code is 400 or higher. These are error responses (like 404 Not Found or 500 Internal Server Error).

The stats count by status command groups the errors by status code and counts how many times each one appeared. This tells you which errors are most common.

  • Click the Statistics tab to see a table of error codes and their counts.
  • Click the Visualization tab.
  • Change the chart type to Bar Chart.
  • Click Save As > Dashboard Panel.
  • For Dashboard, select Existing and choose Buttercup Games - Purchases.
  • For Panel Title, type Error Codes Breakdown.
  • Keep the Panel Content as Bar Chart.
  • Click Save.
  • In the confirmation dialog, click View Dashboard.

Your dashboard now shows three panels: the pie chart, the line chart, and the new bar chart showing error code counts.

Don't see the new panel?

  • Make sure you selected Existing (not New) when choosing the dashboard. If you selected New, you created a second dashboard by accident.
  • Check the time range picker in the top right. If it is set to a narrow window, change it to All time to confirm data appears.

Why isn't my third panel showing on the dashboard?

Add a shared time picker

Right now, each panel uses whatever time range was set when you ran the original search. A shared time picker adds a single control at the top of the dashboard that lets you change the time window for all panels at once.

  • On your dashboard, click Edit in the top right corner.
  • Click Add Input > Time.

A time range picker input appears at the top of your dashboard.

  • Click the pencil icon on the time range picker to edit it.
  • In the Token field, replace the default value with dashboard_time.
  • For Default, set the time range to Last 7 days.
  • Click Apply.

What is a token?

A token is a named variable that passes values between dashboard inputs and panels. When you set the token name to dashboard_time, you are creating a reference that panels can use to read the selected time range.

Naming your token something descriptive (instead of the default field1) makes it easier to identify which input controls which panels.

Connect panels to the time picker

The time picker input you just added is independent from the panels. You need to connect each panel to the shared time picker so they all respond to changes.

  • While still in Edit mode, click the magnifying glass icon (Edit Search) on the first panel (Top Purchases by Category).
  • In the Time Range dropdown, change from Use time picker to Shared Time Picker (dashboard_time).
  • Click Apply.
  • Repeat for the second panel (Web Traffic Over Time): click the magnifying glass icon, change the Time Range to Shared Time Picker (dashboard_time), and click Apply.
  • Repeat for the third panel (Error Codes Breakdown): click the magnifying glass icon, change the Time Range to Shared Time Picker (dashboard_time), and click Apply.
  • Click Save on the dashboard.

Change the time picker value at the top of your dashboard to a different range. All three panels update together to show data for that window.

Why does this matter in production?

In a real SOC (Security Operations Center), analysts need to zoom into the same incident window across all their panels. A shared time picker means one click updates every visualization at once, instead of re-running each search separately.

This is exactly how production SIEM dashboards work. When an alert fires at 2:14 AM, you set the time picker to that window and instantly see traffic, errors, and purchase patterns for the same moment.

Panels not updating when you change the time picker?

  • Make sure you clicked Save after connecting all three panels. Unsaved changes do not persist.
  • Re-enter Edit mode and click the magnifying glass on the panel that is not responding. Confirm the Time Range dropdown shows Shared Time Picker (dashboard_time) and not Use time picker.
  • If your tutorial data is historical, the time picker must cover the data's time range. Try setting it to All time to confirm the panels populate.

Why are my dashboard panels not responding to the shared time picker?

Secret mission

Create a Spike Alert

You have a dashboard that shows what happened. But what if you could make Splunk tell you when something bad is happening right now? In this secret mission, you will build a scheduled alert that automatically monitors error rates and fires when they spike above a threshold. This is the difference between an analyst who reads reports and an engineer who automates monitoring.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in your browser using a Splunk Cloud Platform free trial. There are no ongoing costs, and the trial auto-deletes after 14 days.

Resources you used:

  • Splunk Cloud Platform trial instance (auto-deletes after 14 days).
  • Indexed tutorial data within the trial instance.
  • Downloaded tutorialdata.zip file on your local machine.

Keep everything running

No action needed. Choose this if you want to keep experimenting with Splunk.

  • Your trial lasts 14 days with 5 GB/day of data ingestion.
  • Try uploading your own log data (application logs, web server logs, or system event logs).
  • Build additional dashboards or alerts to practice your SPL skills.
  • The tutorialdata.zip file in your Downloads folder can stay. It is only a few MB.

Pause - I'll come back to this later

There is nothing to pause. The trial stays active for 14 days regardless of whether you use it.

  • Your dashboards, saved searches, and alerts persist until the trial expires.
  • Log back in anytime at your trial URL to pick up where you left off.
  • No charges will be incurred during or after the trial.

Delete - I don't want to use this again

The Splunk Cloud Platform trial cannot be manually deleted early. It will automatically expire and be fully removed after 14 days.

  • When the trial expires, the instance and all data in it is permanently deleted by Splunk. No action is required from you.
  • Delete the tutorialdata.zip file from your Downloads folder to free up local disk space.
  • Your Splunk account (at splunk.com) will remain. You can leave it or log in and visit your account settings to request deletion.

Why can't I delete the trial early?

Splunk Cloud Platform free trials are fully managed by Splunk. Data cannot be exported from the trial instance, and trials cannot be converted to paid accounts. The instance and all indexed data are permanently removed when the 14-day period ends.

Nice Work!

Nice Work!

You went from zero Splunk experience to building a production-style analytics dashboard that turns raw web server logs into actionable visual insights.

You've learned how to:

  • Ingested web server log data into Splunk Cloud Platform and wrote SPL queries using pipe characters and transforming commands to extract insights from raw machine data.
  • Built visualizations (pie charts, bar charts, line charts) from query results and assembled them into a multi-panel interactive dashboard with a shared time picker.
  • Understood the core SIEM workflow: ingest data, index it for fast searching, query it with field-based searches and transforming commands, and present findings visually.
  • Built a scheduled alert that automates error rate monitoring and triggers when HTTP errors spike above a threshold.

Ready to quiz yourself?