Best way to simulating or obtain an commonly data source into Splunk Enterprise for POCs.

[thanh_on]

Hi All,

I don't have many resource to build an ideal network environment to forward logs to Splunk. So, I'm seeking a way to simulating or source to obtain many commonly data sources into Splunk (Like some SIEM solutions have scripts to forward syslog through port 514). Any answer will be highly appreciated.

Regard.

 

[gcusello · Accepted solution]

Hi @thanh_on,

have you access to Splunk Show (https://show.splunk.com/login/?redirect=/)?

here you can find a complete environment to test Enterprise Security with a relevant set of data.

Ciao.

Giuseppe

[isoutamo]

show.splunk.com is mainly targeted to Splunk partners which have fulfilled some additional requirements. It's not for customers (without help from those partners e.g. in sales case).

[thanh_on]

Thank you for your information. Actually, my company is an Splunk Partner so I can login to demo sites. Moreover, I'm still seeking for a RAW commonly data source for customize and fully control to my own Splunk.

Regard.

[isoutamo]

Have you look this https://splunkbase.splunk.com/app/1924 ?

[thanh_on]

Thank you Giuseppe, I have found static Splunk enterprise security demo site. I appreciate your help.