Proj 3x: Splunk Searching (10 pts. extra credit)

What You Need for this Project


To learn the basics of searching in Splunk. This project follows the Splunk tutorial linked in the References at the bottom of this page.

Download the Sample Data

Rich-click on the one of the links below and download the file. Do not unzip it.

Download from Splunk:

Alternative download:

Opening the Splunk Management Page

On your Windows machine, open a Web browser and go to this URL:


A Splunk login page appears, as shown below.

Log in. If you followed the steps in the previous tutorial, your credentials are admin and P@ssw0rd

Uploading the Sample Data

At the top left, click the Splunk logo to go to Splunk Home.

Under Explore Splunk Enterprise, click "Add data".

On the next page, click upload.

Drag the file and drop it onto the "Select Source" page.

The filename appears as a "Selected File" as shown below.

In the top right of the window, click Next.

We need to tell Splunk how to find the hostname in this data.

In the "Input Settings" page, in the center, click "Regular expression on path".

Enter a "Segment number" of

as shown below.

In the top right of the window, click Review.

Click Submit.

Click "Start Searching".

The "New Search" page loads, and populates with data. as shown below.

Just below the search bar, on the left side, it tells you that there are 109,854 events.

The whole point of Splunk is to make it easy to search through large data sets. Splunk is often described as "Google for log data".

Data Summary

At the top left of the Splunk window, in the black bar, click "App Search & Repo".

Click "Search & Reporting".

The Search app opens, as shown below.

On the right side, in the "What to Search" panel, click the "Data Summary" button.

The Hosts tab shows five hosts in this dataset, as shown below.

These are the computers that were monitored to collect this data.

Click the Sources tab to see the eight sources shown below, all of which are log files.

Here are the three source types that are in the tutorial data:

Exploring the Data

Click the Sources tab.


A new search runs. The events that match the search appear in the lower portion of the screen, as shown below.

There are GET and POST requests logged here.

At the top right of the New Search window, expand the date range as needed to see data. On 12-11-17, you need to choose one that goes back a month to see data.

At the top center of the window, the Timeline is visible, showing a green bar for every hour of data.

Move the mouse to hover over a bar. A black pop-up box shows the number of events in that hour, as shown below.

Click the green bar. The data are filtered to show only the events during that hour, as shown below.

Using the Search Assistant

At the bottom right, examine a Web request. Notice that these are requests to a shopping site named

In the Search field, type

Splunk finds the matching term in the data and offers it to you, as shown below.

In the suggestion list, click buttercupgames.

On the right side, click the magnifying glass icon to run the search.

Splunk shows the matching records, highlighting the search term in the results, as shown below.

Saving the Screen Image

Make sure you can see the highlighted word buttercupgames in the lower right of the window, as shown above.

Save a FULL DESKTOP image with the filename Proj 3x from Your Name.

Finding Errors

In the Search field, type
buttercupgames AND error
Splunk finds the error records, as shown below.

The keyword AND is not needed. If multiple items are in the search, Splunk connects them with AND by default.

Change the search to

buttercupgames error
Change the time selection to "All time".

Splunk finds 427 results, as shown below.

Turning in Your Project

Send the image as an email attachment to with a Subject line of Proj 3x from Your Name.


Splunk tutorial

Posted 10-4-17 by Sam Bowne
Cleaned up 10-15-17
Note that it might require looking back a month 12-11-17