Splunk in Your Lab: Install, Forward Windows Logs and Search with SPL

Part of our free Tools & Targets series. Hands-on guides to the vulnerable practice apps and the security tools you will use on the job. Pair it with our Build Your Own Cyber Lab series for the lab to run them in.

1. Vulnerable practice apps: DVWA, bWAPP, Juice Shop, WebGoat, AI Goat and more
2. DVWA walkthrough: every module solved at Low, Medium and High
3. OWASP Juice Shop: beginner and intermediate challenges solved
4. WebGoat and bWAPP: key lessons solved
5. Threat modeling your lab with OWASP Threat Dragon
6. Nessus Essentials: vulnerability scanning your lab
7. Snort and Suricata: network IDS and your first rules
8. Splunk in your lab: install, forward Windows logs, search with SPL (you are here)
9. Wazuh deep dive: file integrity, vulnerability detection and custom rules

Why Splunk, when you already have Wazuh?

Wazuh (our home-lab part 9) is a great free SIEM, but Splunk is still one of the most common SIEMs in job adverts, and its search language, SPL, is a skill in its own right. Running both on the same Windows telemetry teaches you that detections are about the data, not the product.

Step 1: Understand the licence

Splunk Enterprise downloads with a trial licence. When the trial ends, or whenever you switch to it under Settings > Licensing, the instance can run under the Free licence. According to Splunk's "About Splunk Free" page (check the current version before relying on it):

• The Free licence allows you to index 500 MB per day and does not expire. Exceeding the limit produces licence warnings; after 3 warnings in a rolling 30-day window, Splunk keeps indexing but disables search until you are back under the limit.
• It is for standalone, single-instance installs only.
• Alerting is not available. Ingest actions, distributed search, indexer clustering, deployment management and report acceleration are also removed.
• There are no users or roles: no login, and everyone who reaches Splunk Web is an administrator. Keep a Free instance on an isolated lab network.

A small Windows lab with a sensible Sysmon configuration fits comfortably under 500 MB a day. Build your alerts during the trial, and expect them to stop working after conversion.

Step 2: Install Splunk Enterprise on Ubuntu

Use an Ubuntu Server VM with at least 4 CPUs, 8 GB RAM and 50 GB+ disk on the CORP network.

1. Create a free splunk.com account and download the Linux .deb package for Splunk Enterprise.
2. Install and start it:

sudo dpkg -i splunk-<version>-linux-amd64.deb    # use your actual file name
sudo /opt/splunk/bin/splunk start --accept-license

3. You are prompted to create the admin username and password. Optionally make Splunk start at boot with sudo /opt/splunk/bin/splunk enable boot-start (the installation manual describes running it as a dedicated non-root user, which is good practice).
4. Browse to http://<splunk-ip>:8000 and log in.

Create indexes and enable receiving

1. Settings > Indexes > New Index: create wineventlog and sysmon. Separate indexes make searches faster and retention easier to manage.
2. Settings > Forwarding and receiving > Configure receiving > New Receiving Port: enter 9997. (The CLI equivalent is /opt/splunk/bin/splunk enable listen 9997.)
3. Allow TCP 9997 from the lab clients through the Ubuntu firewall if you enabled ufw in part 5.

Step 3: Install the add-ons on the indexer

Field extractions come from add-ons. Install these from Apps > Find More Apps (or upload them from Splunkbase):

• Splunk Add-on for Microsoft Windows - parses Security, System and Application logs.
• Splunk Add-on for Sysmon - parses the Sysmon operational log.

Read each add-on's documentation for the exact sourcetypes it expects. Field names depend on the add-on and on whether events are rendered as XML, so the searches below show common names; if a field comes back empty, open one raw event and use the names you actually see.

Step 4: Universal Forwarder on Windows

On your Windows client (and DC01 from home-lab part 6), install Sysmon first as described in home-lab part 9, then:

1. Download the Universal Forwarder MSI for Windows from splunk.com.
2. Run it, accept the licence, and when asked for the receiving indexer, enter <splunk-ip> and port 9997. Skip the deployment server for a lab.
3. Create an inputs.conf for the logs you want. A simple place is C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf (in production you would package it in an app):

[WinEventLog://Security]
disabled = 0
index = wineventlog

[WinEventLog://System]
disabled = 0
index = wineventlog

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
renderXml = true
index = sysmon

4. Restart the SplunkForwarder service (Services console, or Restart-Service SplunkForwarder in an elevated PowerShell).
5. On the Splunk server, search index=wineventlog OR index=sysmon | stats count by host, sourcetype. You should see each Windows host with its sourcetypes within a minute or two.

Step 5: SPL basics

SPL is a pipeline: the first part retrieves events, and each | passes results to the next command.

Always set the time picker. "All time" on a busy index is slow even in a lab.

Step 6: Detection searches

Failed logons (4625) by account and source

index=wineventlog EventCode=4625
| stats count AS failures, values(host) AS hosts BY Account_Name, Source_Network_Address
| where failures > 5
| sort - failures

Generate data by mistyping a password several times over RDP or SMB from Kali. With XML-rendered events the equivalent fields are usually TargetUserName and IpAddress; with the Windows add-on's normalised fields, user and src.

New service installed (7045)

Attackers and tools such as PsExec install services to run code. Event 7045 in the System log records each one:

index=wineventlog EventCode=7045
| table _time, host, Service_Name, Service_File_Name, Service_Account

Look for services whose binary lives in a user-writable folder, or a command line that launches cmd.exe or powershell.exe.

Suspicious command lines (Sysmon Event ID 1)

index=sysmon EventCode=1
  (CommandLine="*-enc*" OR CommandLine="*DownloadString*" OR CommandLine="*urlcache*" OR CommandLine="*bypass*")
| table _time, host, User, ParentImage, Image, CommandLine

Then pull out an encoded PowerShell payload into its own field with rex:

index=sysmon EventCode=1 Image="*\\powershell.exe" CommandLine="*-enc*"
| rex field=CommandLine "(?i)-enc\w*\s+(?<encoded>[A-Za-z0-9+/=]{20,})"
| table _time, host, encoded

And see when it happens:

index=sysmon EventCode=1 CommandLine="*-enc*"
| timechart span=1h count BY host

Test these by running a harmless encoded command on your own lab client, such as one that only prints a message.

Step 7: Dashboards and alerts

• Dashboards: run a search, choose Save As > Dashboard Panel, and build a "Lab SOC" dashboard with failed logons over time, new services, and top Sysmon parent/child process pairs.
• Alerts: during the trial, Save As > Alert on the failed-logon search with a schedule and a trigger condition. Remember the Free licence removes alerting; afterwards, keep the searches as saved reports and run them on demand.

Step 8: Practise on Boss of the SOC v3

Splunk's BOTS v3 dataset is a realistic, pre-indexed capture of an attack against a fictional company, built for capture-the-flag events. The GitHub README explains the setup: download the dataset, check its MD5, install the listed add-ons at matching versions, untar it into $SPLUNK_HOME/etc/apps, restart, and search index=botsv3 earliest=0. Because it is pre-indexed, you add it rather than ingest it - read the README for details. Work through it like an investigation: start from one odd event, pivot on host and user, and build a timeline.

Keep it legal and contained

Only scan, probe or attack machines you own or have written permission to test. Keep vulnerable targets on an isolated lab network with no route to your home LAN or the internet, and never point a scanner or exploit at an address you do not control - even "just to see" is unauthorised access in most jurisdictions.

Next step

Part 9 goes deep on Wazuh: file integrity monitoring, vulnerability detection, custom rules and active response. To practise SIEM searches on prepared incidents in the browser, try our SIEM lab, log analyzer and threat-hunting lab.