Splunk Enterprise Security

Splunk ES tutorials and sample data dump

inventsekar
Super Champion

I have used that search tutorials for splunk.
Is there any similar one splunk ES?!?!

For splunk, there is a tutorials data zip file splunk provides. For learning ES, is there any data dump to play with?!?!

Thx..

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
1 Solution

mgaudie_splunk
Splunk Employee
Splunk Employee

Your best bet is to use Eventgen data. A lot of TA's out there, such as Cisco ASA, Blue Coat Proxy and Windows have a "samples" directory and an eventgen.conf file that Eventgen can use to create sample data for your environment. As you add more eventgen sources into ES, the more you'll light up the dashboards and see the functionality.

That being said, ES has quite a different knowledge requirement to Splunk Core, so this shouldn't be a replacement for undertaking ES training.

View solution in original post

Splunker
Communicator

Absolutely - try out the Event Generator app.

https://splunkbase.splunk.com/app/1924/

It should generate some data to light up ES to learn on it.

Also, check out the BOTS (Boss of the SOC) v1 competition dataset, as well.

https://github.com/splunk/botsv1

Cheers.

mgaudie_splunk
Splunk Employee
Splunk Employee

Your best bet is to use Eventgen data. A lot of TA's out there, such as Cisco ASA, Blue Coat Proxy and Windows have a "samples" directory and an eventgen.conf file that Eventgen can use to create sample data for your environment. As you add more eventgen sources into ES, the more you'll light up the dashboards and see the functionality.

That being said, ES has quite a different knowledge requirement to Splunk Core, so this shouldn't be a replacement for undertaking ES training.

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...