topic Re: Where can I get the updated sample data for practicing searches using SPL? in Getting Data In

Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Mon, 19 Dec 2022 20:17:32 GMT

please where can i get the updated sample data for practicing searches using SPL? thanks in advance

Re: Where can I get the updated sample data for practicing searches using SPL?

richgalloway — Mon, 19 Dec 2022 21:46:46 GMT

You can get sample data literally anywhere. Any data can be used to practice searching. Your own workstation probably is the best place to start. If you want more variety in your data, download the BOTS3 (Boss Of The SOC version3) dataset at https://github.com/splunk/botsv3

Re: Where can I get the updated sample data for practicing searches using SPL?

gcusello — Tue, 20 Dec 2022 08:10:32 GMT

Hi @Lorenzo1,

you can use the hint of @richgalloway or see at https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchTutorial/Systemrequirements#Download_the_tutorial_data_files

Ciao.

Giuseppe

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Tue, 27 Dec 2022 02:48:04 GMT

hi @richgalloway thanxx bro i seen it in v3.

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Tue, 27 Dec 2022 03:32:36 GMT

hey bro do i need to download and install all the app/add -on before installing the BOTS v3? Cos i decided not to download the ones that had to do with microsoft and windows since am using Mac.

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Tue, 27 Dec 2022 06:04:24 GMT

also i tried to scp the .tgz file from my local folder to the virtual server so i can untar and install it there but was getting "permission denied" error (screenshot attached). can you help pls.

Re: Where can I get the updated sample data for practicing searches using SPL?

PickleRick — Tue, 27 Dec 2022 09:48:30 GMT

It's out of scope of this forum I'm afraid. It's not that I don't want to help you out here but you obviously have problems with most basic unix CLI operations so it's better that you train somewhere else than if I give you a copy-paste solution which you can mistype and break your whole installation.

Find some basic unix/linux CLI tutorial and start from there.

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Wed, 28 Dec 2022 23:54:08 GMT

i dont understand . i already have a good hand in linux. If i could deploy a fully clustered splunk environment then i dont think i need basic linux training. But its ok if you say so. thanxx.

Re: Where can I get the updated sample data for practicing searches using SPL?

richgalloway — Thu, 29 Dec 2022 00:59:57 GMT

Use chmod to set the permissions.

You do not need any apps or add-ons to use the BOTS data set.

Re: Where can I get the updated sample data for practicing searches using SPL?

PickleRick — Thu, 29 Dec 2022 07:14:39 GMT

Sorry, mate, but it seems so.

From the screenshots you provided it seems that you're trying to "run" your home directory and your scp syntax is wrong (use man scp to read about it). It's not an insult. It's just pointing out that you're missing the basics.

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Fri, 30 Dec 2022 21:29:43 GMT

ok lemme try that. Thanks for your time.

Re: Where can I get the updated sample data for practicing searches using SPL?

Lorenzo1 — Sat, 31 Dec 2022 08:07:29 GMT

hi @richgalloway ,

so i was able to install botsv3 but got this error after restarting and splunkd stopped running. pls how can i solve this cos i can see am almost there. thanxx.

homePath='/opt/splunk/etc/apps/botsv3_data_set/var/lib/splunk/botsv3/db' of index=botsv3 on unusable filesystem.

Validating databases (splunkd validatedb) failed with code '1'

attached is the screenshot,

Re: Where can I get the updated sample data for practicing searches using SPL?

richgalloway — Sat, 31 Dec 2022 13:37:18 GMT

You'll need to fix the filesystem on which the botsv3 index is stored. Perhaps it's in read-only mode or maybe the permissions on the botsv3 directory are incorrect.