Getting Data In

Is there any repository for sample raw audit logs for various software platforms?


We are planning to procure several software platforms (e.g. Workday, Salesforce, Contact Center CX etc) in the near future as part of an expansion effort. I'm trying to get ahead and understand what the raw logs for each of these various platforms will look like so that our SOC Team can start producing pseudo SPL queries that we can eventually incorporate into Splunk for reporting and alerting. Is there any online repo that has sample raw logs from such platforms (preferably from their sandbox environment) that we could upload as flat files to Splunk and start experimenting with (e.g. parsing, transforming, etc)?

Labels (3)
0 Karma


Hi @adnankhan5133 .. this will be a difficult task actually, to find out sample logs for some apps(just now i did search for Salesforce sample logs, but no luck)..

the EventGen is a good tool for creating the sample logs, but there are some challenges:

1) You should know the log format beforehand. 

2) configuring the EventGen, at times, is a difficult task. 


maybe, check this one.. we can get logs like.. hadoop, apache, openstack, many more apps sample logs are collected there.


0 Karma


Hello @adnankhan5133 ,

I'm not much aware of any repo present for raw logs for different platforms. However, you can use Eventgen to generate different logs before onboarding them into production.

You can refer to the following documents for using EventGen:



If the above helps, an upvote is appreciated..!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...