Analyze Security Logs with Splunk

Set up a local SIEM, ingest Apache logs, and build a security dashboard.

Introduction

30 Second Summary

Every time a company reports a data breach, the first thing investigators do is check the logs. Logs are like security camera footage for your network, recording every visitor, every request, and every failed attempt to get in.

In this project, you will set up a professional security analytics tool on your own computer, ingest real log data, write queries to hunt for suspicious patterns, and build a dashboard that visualizes your findings.

What You'll Build

A local security analytics environment powered by Splunk Free that lets you ingest log data, query it with SPL (Splunk Processing Language), and visualize security metrics on a custom dashboard.

By the end of this project, you'll have:

A running Splunk Enterprise instance on your Windows machine with the Free license activated (no expiration, no cost).
A working set of SPL queries that extract meaningful insights from security logs including failed requests, error trends, and traffic patterns.
A custom Splunk dashboard with multiple panels visualizing error trends, popular pages, and top client IP addresses.
Secret Mission: A brute-force detection query that flags repeated failed access attempts from a single source.

Are there any prerequisites?

None. This project includes full setup instructions for every tool you need. All you need is a Windows computer and a web browser.

Install Splunk Enterprise on Windows

Every security investigation starts with logs. To analyze those logs at scale, you need a tool that can ingest thousands of events, let you search through them instantly, and visualize patterns over time.

In this step, you will install Splunk Enterprise on your Windows machine and activate the Free license. This gives you a permanent, no-cost SIEM environment to practice real log analysis.

What is a SIEM?

A SIEM (Security Information and Event Management) system collects logs from across your infrastructure, indexes them for fast searching, and helps you spot suspicious activity. Splunk is one of the most widely used SIEMs in the industry.

SOC (Security Operations Center) analysts use SIEMs every day to investigate alerts, hunt for threats, and build dashboards that surface security insights.

In this step, get ready to:

Download and install Splunk Enterprise on Windows.
Activate the Free license for permanent, no-cost access.
Open the Search and Reporting app to confirm everything works.

Download and install Splunk Enterprise

Splunk Enterprise is a free download that starts with a 60-day trial. You will switch it to the permanent Free license shortly after installation.

Open your web browser and go to the Splunk Enterprise download page.
Click Create Your Account if you do not already have a Splunk account.
Fill in your details and create your free account. No credit card is required.
After signing in, select the Windows tab on the download page.
Click the Download Now button for the 64-bit .msi installer.
Wait for the download to finish. The file is named splunk.msi (or a versioned variant like splunk-10.4.0-....msi).

Now run the installer.

Double-click the splunk.msi file in your Downloads folder to launch the installer.
Check the Check this box to accept the License Agreement checkbox.
Click Next to install with the default settings.

What do the default settings do?

Choosing the defaults installs Splunk to C:\Program Files\Splunk, configures the default web port (8000), and sets Splunk to run as the Local System user. This is the simplest option for a personal learning machine.

On the Choose the user Splunk Enterprise should run as panel, select Local System and click Next.
Create your administrator credentials. Set the username to admin and choose a memorable password.
Click Next to begin the installation.

Remember your password

Write down the password you chose. You will need it to log in before switching to the Free license.

Wait for the installation to complete. This may take a few minutes.
On the final panel, check the Launch browser with Splunk checkbox.
Click Finish.

Your default browser opens and loads Splunk Web at http://localhost:8000. You should see the Splunk login page.

Browser did not open?

If your browser did not launch automatically, open it manually and navigate to http://localhost:8000. If the page does not load, Splunk may still be starting. Wait 30 seconds and try again.

If port 8000 is in use by another application, Splunk Web will not start. Close any other app using that port and restart Splunk from the Start Menu shortcut.

help me troubleshoot why Splunk Web is not loading at localhost:8000

Switch to the Free license

Splunk installs with a 60-day Enterprise Trial by default. Switching to the Free license now gives you a permanent environment with no expiration date.

Log in to Splunk Web with your admin credentials (username: admin, the password you set during installation).
Click Settings in the top menu bar.
Click Licensing.
Click Change License Group.
Select Free license.
Click Save.
Splunk prompts you to restart. Click Restart and wait for the process to finish.

After the restart, Splunk Web reloads automatically. You are now passed straight into Splunk Web as an administrator-level user with no login prompt.

Why is there no login screen?

The Free license removes all user authentication. There is no login page because the Free license does not support users or roles. You are always signed in as the admin.

This is expected behavior for a local learning environment. The Free license allows 500 MB of data ingestion per day and does not expire.

Still seeing a login screen after restart?

If you still see a login prompt, the license switch may not have taken effect. Log in with your admin credentials, then go back to Settings and Licensing to confirm the Free license is active. If it still shows Enterprise Trial, repeat the switch steps above.

help me switch Splunk Enterprise to the Free license

Verify your Splunk installation

With the Free license active, confirm that the Search and Reporting app is accessible.

On the Splunk Home page, locate the Search & Reporting app in the left panel.
Click Search & Reporting to open it.

You should see the Search bar at the top of the page, ready for you to type queries.

Your Splunk environment is installed and ready. Next up, you will load real log data into Splunk so you have something to search and analyze.

Ingest the Tutorial Dataset

Your Splunk instance is installed and the Free license is active. Now you need data to analyze.

A SIEM is only useful when it has log data to work with. In this step, you will download and upload Splunk's official tutorial dataset, which contains Apache web access logs and vendor sales data from a fictional online store called Buttercup Games.

In this step, get ready to:

Download the tutorial dataset from Splunk's documentation.
Upload the data into Splunk using the Add Data wizard.
Verify the data is indexed and searchable.

Download the tutorial data

Splunk provides a purpose-built dataset for learning SPL. The file is small and pre-formatted so Splunk can parse it immediately.

Open the Splunk Search Tutorial documentation page in your browser:
https://help.splunk.com/en/splunk-enterprise/search/search-tutorial/10.4/part-1-getting-started/what-you-need-for-this-tutorial
Scroll down to the Download the tutorial data files section.
Click the link to download tutorialdata.zip.
Save the file to your Downloads folder.
Do NOT unzip the file. Splunk requires it to remain compressed for upload.

Why keep the file zipped?

Splunk's Add Data wizard is designed to handle compressed files directly. It automatically extracts the contents and identifies the source types inside. If you unzip the file first, the upload process may not work correctly.

File automatically unzipped?

Some browsers (especially Safari) automatically extract ZIP files after downloading. Check your Downloads folder for tutorialdata.zip specifically. If you only see an unzipped folder, re-download the file after disabling auto-extraction in your browser settings.

help me fix my tutorialdata.zip file being automatically unzipped

Upload the data to Splunk

Splunk's Add Data wizard walks you through ingesting files into an index. Once the data is indexed, it becomes searchable with SPL.

In Splunk Web, click Settings in the top navigation bar.
Click Add Data.
Click Upload at the bottom of the page (the leftmost option).
Click Select File and choose the tutorialdata.zip file from your Downloads folder.
Click Next to continue to Input Settings.
On the Input Settings page, leave the index set to main (the default).
Click Review.
Click Submit to begin ingestion.

What is log ingestion?

Ingestion is the process of importing raw data into Splunk so it can be indexed and searched. During ingestion, Splunk parses the raw text into individual events, assigns timestamps, and extracts fields like status, clientip, and uri_path.

The main index is Splunk's default storage location for events. Think of it like a database table where all your log entries live.

Skipped a step?

Because you uploaded a compressed ZIP file, Splunk automatically detects the source types inside. You may notice that the Set Source Type step is skipped entirely. This is normal behavior for compressed file uploads.

Verify the data loaded successfully

Now you will confirm that Splunk ingested the tutorial data and that it is ready for searching.

After the upload completes, click Start Searching to open the Search app.
In the search bar, type the following query:

index=main

Click the time range picker on the right side of the search bar.
Select All time.
Press Enter or click the green search button to run the query.

You should see thousands of events appear in the results. The Events tab shows Apache access log entries with timestamps, HTTP methods, status codes, and URIs.

What is in this dataset?

The tutorial data simulates logs from Buttercup Games, a fictional online store. It includes Apache web access logs (recording every page visit and HTTP request) and vendor sales logs (recording purchase transactions).

Splunk automatically parses these raw logs into searchable fields like clientip, status, productid, and _time. These fields are what you will use in SPL queries to hunt for patterns.

No events showing up?

Make sure the time range is set to All time. The tutorial data contains events from the past seven days relative to when the file was generated. If your time picker is set to a narrow range, the events may fall outside it.

If you still see zero results, go back to Settings > Add Data > Upload and re-upload the tutorialdata.zip file. Confirm you see a success message after clicking Submit.

help me troubleshoot why my Splunk search for index=main returns no events

Your Splunk instance now has real log data to work with. Next up, you will write SPL queries to search this data for errors, patterns, and security insights.

Write Your First SPL Queries

Your Splunk instance now has real log data ready to explore. The next question is: how do you actually find useful information inside thousands of raw events?

This is where SPL (Splunk Processing Language) comes in. SPL is the query language you use to search, filter, and transform data inside Splunk. In this step, you will write queries that hunt for errors, summarize events by category, and chart trends over time.

In this step, get ready to:

Search for errors and failed requests using keyword and field-based queries.
Summarize event data with transforming commands like stats.
Visualize trends over time using timechart.

Search for errors and failures

Security analysts spend most of their time hunting for signs of trouble in logs. The simplest approach is a keyword search that surfaces any event mentioning errors or failures.

In the Search and Reporting app, click the time range picker (to the right of the search bar).
The default time range is Last 24 hours. Click All time under the Other section so your searches cover the entire tutorial dataset.
Type the following query into the search bar and press Enter to run it:

index=main (error OR fail OR failure OR failed)

What does this query do?

This searches every event in the main index for any of the keywords: error, fail, failure, or failed.

The OR operator lets you match any of the terms in a single search. Splunk highlights the matched terms in yellow so you can spot them quickly.

You should see events appear in the Events tab with your search terms highlighted.

Now refine your search to focus on a specific HTTP status code. Clear the search bar and run this query:

index=main status=404

What is a field filter?

Instead of searching for the text "404" anywhere in an event, status=404 targets the specific status field that Splunk extracted from the Apache logs. This is more precise than keyword searching because it only returns events where the HTTP status code is exactly 404 (page not found).

You should see a filtered list of events where the HTTP response was a 404 error.

Not seeing any results?

Make sure the time range picker is set to All time. The tutorial data has timestamps from a specific period that falls outside the default Last 24 hours range.

Also double-check that your query matches exactly what is shown above. SPL field names are case-sensitive.

help me troubleshoot why my SPL query returns no results in Splunk

Use transforming commands to summarize data

Keyword searches show you individual events. Transforming commands aggregate those events into tables and counts, which is how you start spotting patterns across an entire dataset.

Run this query to count events grouped by HTTP status code:

index=main | stats count by status

What does the pipe do?

The pipe character (|) sends the results of the search on the left into the command on the right. Think of it like an assembly line: first Splunk finds all events in main, then it passes them to stats count by status which groups and counts them.

The stats command is one of SPL's transforming commands. It calculates aggregate values (count, sum, average) and outputs a table.

Click the Statistics tab to see the results as a table. You should see a list of HTTP status codes (200, 404, 500, etc.) with a count for each.

Run another transforming query to see how events break down by log type:

index=main | stats count by sourcetype

In the Statistics tab, you should see a table showing event counts for each source type in your dataset (the Apache access logs and vendor sales logs).

Seeing results in the Events tab but not the Statistics tab?

Transforming commands like stats send their output to the Statistics tab, not the Events tab. Make sure you click Statistics after running the query.

help me understand why my Splunk stats query results appear in the Statistics tab

Visualize trends over time

Tables tell you what happened. Charts tell you when it happened. The timechart command groups events into time buckets so you can see spikes, drops, and patterns at a glance.

Run this query to chart all events over time, broken down by status code:

index=main | timechart count by status

Click the Visualization tab to see a line chart of events over time.

What does timechart do?

The timechart command is like stats, but it automatically groups results by time intervals. Splunk picks an appropriate bucket size based on your time range. The by status clause splits the chart into separate lines for each status code.

In a real security environment, you would use this to spot sudden spikes in error codes that could indicate an attack or system failure.

You should see a line chart with time on the x-axis and event count on the y-axis. Each status code gets its own colored line.

Now narrow the visualization to just 404 errors. Run this query:

index=main status=404 | timechart count

Click the Visualization tab again.

You should see a time-series chart showing when 404 errors occurred, with visible peaks and valleys. These peaks could represent scanning activity, broken links, or probing by an attacker.

Chart looks empty or flat?

If the chart shows nothing, confirm your time range is set to All time. If the chart is a flat line, try zooming in by changing the time range to a narrower window around where the data events are concentrated.

help me troubleshoot my Splunk timechart visualization

You now have a working toolkit of SPL queries for searching, summarizing, and charting log data. Next up, you will turn these queries into a permanent dashboard that visualizes your security insights at a glance.

Build a Security Dashboard

You now have a toolkit of SPL queries that can surface errors, count events, and track patterns over time. Running queries one at a time is great for exploration, but a SOC analyst needs to see multiple metrics at a glance.

In this step, you will build a custom dashboard that combines your queries into a single view. Dashboards give you a visual command center where error spikes, popular pages, and suspicious IPs are all visible at once.

In this step, get ready to:

Create a new Classic Dashboard in Splunk.
Add visualization panels for error trends, top pages, and top client IPs.
Save your finished Security Overview dashboard.

Create a new dashboard

A dashboard is a collection of panels, each powered by its own SPL query. You will create an empty dashboard first, then fill it with panels in the next substeps.

In the Search and Reporting app, click Dashboards in the top navigation bar.
Click Create New Dashboard.
Enter Security Overview as the dashboard title.
Select Classic Dashboards as the dashboard type.
Click Create Dashboard.

You are now in the Dashboard Editor with an empty canvas ready for panels.

What is a Classic Dashboard?

Splunk offers multiple dashboard frameworks. Classic Dashboards use a simple drag-and-drop editor that does not require any code knowledge. They are the best starting point for learning dashboard creation.

Add your first two panels

Each panel on a dashboard is powered by an inline SPL search. You will add a line chart showing error trends and a column chart showing the most-requested pages.

Click Add Panel.
Expand the New category and select Line Chart.
In the search box, enter the following query:

index=main status>=400 | timechart count by status

Set the time range to All time.
Click Add to Dashboard.

Your first panel appears on the dashboard showing error status codes over time.

Click Add Panel again.
Expand New and select Column Chart.
In the search box, enter the following query:

index=main | top limit=10 uri_path

Set the time range to All time.
Click Add to Dashboard.

You should now see two panels side by side on your dashboard.

What do these queries do?

The first query filters for HTTP status codes 400 and above (client and server errors) and charts their count over time. This reveals when error spikes happened.

The second query uses the top command to find the 10 most-requested URI paths. Pages that get hit the most are often targets for attackers or indicators of user interest.

Panel showing no results?

Make sure the time range is set to All time for each panel. The tutorial data has timestamps from a specific historical window, so a default time range of "Last 24 hours" returns zero events.

Also check that your query matches exactly what is shown above, including the pipe character (|) between commands.

Help me troubleshoot why my dashboard panel shows no results.

Add a statistics panel and save

The final panel shows a table of the top 10 client IP addresses by request volume. High-volume IPs are worth investigating because they may indicate automated scanning or brute-force attempts.

Click Add Panel.
Expand New and select Statistics Table.
In the search box, enter the following query:

index=main | stats count by clientip | sort -count | head 10

Set the time range to All time.
Click Add to Dashboard.
Click Save in the top-right corner to save your dashboard.

What does this query do?

This query counts every event by its clientip field, sorts the results in descending order (sort -count), and keeps only the top 10 rows (head 10).

The result is a ranked list of the most active IP addresses hitting the web server. In a real environment, an unusually high count from a single IP could be a sign of automated scanning.

Your "Security Overview" dashboard now shows three panels: a line chart of error trends by status code, a column chart of the most-requested pages, and a table of the top 10 client IP addresses by request volume.

Don't see all three panels?

Make sure you clicked Add to Dashboard after entering each query. If you navigated away before clicking this button, the panel was not saved.

If a panel appears blank after saving, click Edit on the dashboard, then click the magnifying glass icon on the blank panel to verify the search string and time range are correct.

Help me fix my Splunk dashboard panels.

Secret mission

Build a Brute-Force Detection Query

Your dashboard shows what happened, but can it catch an attack in progress? Real SOC analysts use threshold-based detection to flag suspicious behavior automatically. In this secret mission, you will build a brute-force detection query that identifies IPs hammering your server with failed requests, then save it as a reusable report on your dashboard.

Clean Up Your Resources

This project runs entirely on your local machine using the Splunk Free license. There are no cloud resources or ongoing costs to worry about.

Decide whether to keep Splunk running, pause it to free up system resources, or delete it entirely.

Resources you used:

Splunk Enterprise installed at C:\Program Files\Splunk (uses disk space for the application and indexed tutorial data).
Splunk Free license (no expiration, no cloud usage).
A splunk.com account (used to download the installer).

Keep everything running

No action needed. Choose this if you plan to keep exploring Splunk and loading more data.

Splunk stays installed and your "Security Overview" dashboard, saved reports, and indexed data all remain intact.
The Free license has no expiration. You can use Splunk indefinitely with the 500 MB/day indexing limit.
Your splunk.com account remains active for downloading future updates or apps.

Pause - I'll come back to this later

Stop the Splunk service to free up memory and CPU when you are not using it. Your data and dashboards are preserved on disk.

Press the Windows key, type services, and press Enter to open the Services control panel.
Find Splunkd Service in the list.
Right-click it and select Stop.
To start Splunk again later, return to the same Services panel and click Start on the Splunkd Service.

Delete - I don't want to use this again

Remove Splunk Enterprise completely from your machine. This deletes the application, your indexed data, dashboards, and saved reports.

Press the Windows key, type Add or remove programs, and press Enter.
Find Splunk Enterprise in the list of installed apps.
Click Uninstall and follow the prompts. If Windows asks you to reboot, you can safely ignore it.
After uninstalling, the C:\Program Files\Splunk folder may still contain leftover configuration and index files. Delete this folder manually to fully remove all traces.

Why delete the folder manually?

The Windows uninstaller removes the Splunk application binaries but may leave your configuration and index files behind. Deleting the installation directory ensures a clean removal.

Nice Work!

You just built a fully operational security analytics environment using Splunk Free. From installation to dashboard creation, you now have hands-on experience with the same SIEM platform used by SOC analysts worldwide.

Here's what you accomplished:

Installed Splunk Enterprise on Windows and activated the Free license with 500 MB/day indexing and no expiration.
Wrote SPL queries using stats, timechart, top, where, and sort to analyze security events in real log data.
Built a multi-panel Security Overview dashboard visualizing error trends, top-requested pages, and the most active client IPs.
Secret Mission: Created a brute-force detection query using threshold logic and saved it as a reusable report on your dashboard.

Ready to quiz yourself?