Splunk Enterprise Security

Splunk ES tutorials and sample data dump

inventsekar
Super Champion

I have used that search tutorials for splunk.
Is there any similar one splunk ES?!?!

For splunk, there is a tutorials data zip file splunk provides. For learning ES, is there any data dump to play with?!?!

Thx..

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
1 Solution

mgaudie_splunk
Splunk Employee
Splunk Employee

Your best bet is to use Eventgen data. A lot of TA's out there, such as Cisco ASA, Blue Coat Proxy and Windows have a "samples" directory and an eventgen.conf file that Eventgen can use to create sample data for your environment. As you add more eventgen sources into ES, the more you'll light up the dashboards and see the functionality.

That being said, ES has quite a different knowledge requirement to Splunk Core, so this shouldn't be a replacement for undertaking ES training.

View solution in original post

Splunker
Communicator

Absolutely - try out the Event Generator app.

https://splunkbase.splunk.com/app/1924/

It should generate some data to light up ES to learn on it.

Also, check out the BOTS (Boss of the SOC) v1 competition dataset, as well.

https://github.com/splunk/botsv1

Cheers.

mgaudie_splunk
Splunk Employee
Splunk Employee

Your best bet is to use Eventgen data. A lot of TA's out there, such as Cisco ASA, Blue Coat Proxy and Windows have a "samples" directory and an eventgen.conf file that Eventgen can use to create sample data for your environment. As you add more eventgen sources into ES, the more you'll light up the dashboards and see the functionality.

That being said, ES has quite a different knowledge requirement to Splunk Core, so this shouldn't be a replacement for undertaking ES training.

Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...