Splunk® Enterprise

Search Tutorial

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

What is in the tutorial data?

The tutorial data file is updated daily and contains events that are timestamped for the previous seven days. The tutorial data contains several types of information about the fictitious online store Buttercup Games. Buttercup, for those of you that don't know, is a pony and is the Splunk mascot.

The information includes access.log files, secure.log files, and vendor_sales.log files from mail servers and web accounts.

access.log file data

The raw data in the access.log file is difficult to read and analyze when you have hundreds, if not thousands, of lines of data. Each day, every day. That is where the Splunk platform comes in. - - [22/Sep/2016:18:44:40] "POST /product.screen?productId=WC-SH-A01&JSESSIONID=SD7SL9FF5ADFF5066 HTTP 1.1" 200 3067 "http://www.buttercupgames.com/product.screen?productId=WC-SH-A01" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)" 307 - - [22/Sep/2016:19:20:13] "GET show.do?productId=SF-BVS-01&JSESSIONID=SD6SL8FF4ADFF5218 HTTP 1.1" 404 1329 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-13" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 674

secure.log file data

The raw data in the secure.log file looks like this:

Thu Sep 22 2016 00:15:06 mailsv1 sshd[60445]: pam_unix(sshd:session): session opened for user djohnson by (uid=0)
Thu Sep 22 2016 00:15:06 mailsv1 sshd[3759]: Failed password for nagios from port 3769 ssh2
Thu Sep 22 2016 00:15:08 mailsv1 sshd[5276]: Failed password for invalid user appserver from port 3351 

vendor_sales.log file data

The raw data in the vendor_sales.log file looks like this:

[22/Sep/2016:18:23:07] VendorID=5037 Code=C AcctID=5317605039838520
[22/Sep/2016:18:23:22] VendorID=9108 Code=A AcctID=2194850084423218
[22/Sep/2016:18:23:49] VendorID=1285 Code=F AcctID=8560077531775179
[22/Sep/2016:18:23:59] VendorID=1153 Code=D AcctID=4433276107716482

Next step

Let's upload the tutorial data to your Splunk deployment.

Last modified on 23 August, 2017
About uploading data
Upload the tutorial data

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters