Splunk Enterprise Security

Datasets and ideas for Splunk Enterprise Security


Hello the team,

I am currently preparing a Splunk Lab for my office, and I need the datasets specially for Splunk Enterprise Security.

I am trying to deploy a Splunk Entreprise Security (ES) environment in our Lab but we have a lack of data (Events, Notable Events, …)


Can u propose to me some datasets to aliment ES ? Otherwise, what u can propose as suggestions to deploy Splunk Enterprise Security in our Splunk Lab.


Thanks in advance for your help.

Have a nice day.

Ultra Champion

ahh, the splunk ES datasets are sooo complex. 

but, i would suggest you to register for a Splunk ES Sandbox



and then, try to replicate/create,  as many as possible to you, on your lab. all the very best for your ES Lab Setup(i wish i had one for me too)


Best Regards,


PS - your karma points will be my 2 cents!



Thank you so much for your response. 

The link https://www.splunk.com/page/sign_up/en_us/getsplunk/es_sandbox doesn't work for me! 

i already have a splunk account, when i tryed to log-on, i was redirected to splunk.com 


Can you please connect to your account and then, send me the link for ES_Sandbox

Thank you in advance. 


Best regards.


0 Karma


Enterprise Security uses data already indexed by Splunk  That is, the stuff from your firewalls, AD, servers, etc..  There's nothing special about ES data.

ES will create notable events when you enable the appropriate correlation searches and those searches find something of note in your data.

I recommend you clone some of your production data to your lab so you have a "realistic" data set.

If this reply helps you, Karma would be appreciated.


Hello richgalloway, 

Thank you so much for your response. 

I try to generate ficitf data from Eventgen, and realize ES scenarios. It's difficult to clone some of production data to the lab.

I have now an other problem, ES doesn't create notable events when i enable the appropriate correlation searches.  Where it can come  from? any ideas? 


Thanks in advance.


PS:  i give you the upvote! 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...