Learning controls
Skip to learning
Lab terminal
Splunk Core UserFree0 of 18 labs completeSave your progress →
SPLUNK CORE USER / LESSON 1 OF 18

Splunk Core User

Meet Splunk and Prepare Your Lab

Get your practice server ready and learn what Splunk will help you do.

Splunk Enterprise 10.4+ · supported Windows Server guest · cloudseam.tech dummy data · SPL (not SPL2) · 0/18 lessons self-verified
Your practice files and setup help

Download these inside your practice VM. All three files contain fictional lab data. Upload each event CSV only once using Add Data when its lesson asks you to. Use cloudseam-status.csv only in Lookups.

Download cloudseam-web.csv · 12 eventsDownload cloudseam-security.csv · security investigationsDownload cloudseam-status.csv · lookupNeed a VM? Open the VMware setup lab

Paste SPL into Splunk Web’s Search bar, not the SONIC terminal or PowerShell. A reference picture shows real vendor controls, not your own result.

What you’ll do in this lab

3 steps · use “In this lab” to jump to a step.

LET’S GET READY

What you’ll need

  • A supported x86-64 Windows Server guest called SPLUNK01, with resources checked against the selected release’s official requirements.
  • An official Splunk Enterprise installer and a trial/license that permits scheduling; a website visit does not create an entitlement.
  • The supplied 12-event cloudseam-web.csv and three-row cloudseam-status.csv files. All names and events are fictional.
  • A private browser session on the guest at http://localhost:8000 after installation. No paid Azure resources are needed.
  • The supplied 16-event cloudseam-security.csv for injection-pattern and external-login investigations. No attacks are sent; you analyze prepared logs.

Your first move: Use a separate Windows Server 2019 or 2022 practice VM from the Windows Server & VMware pathway. Your Windows 10 computer stays the VMware host; do not install an unsupported Splunk release on it.

Let’s do this together

0/3 steps checked
STEP 1 OF 3

Choose the practice computer

WHERE TO WORK

Your Windows host → VMware Workstation Pro → Windows Server guest

Let’s try it

  1. Use a separate Windows Server 2019 or 2022 practice VM from the Windows Server & VMware pathway. Your Windows 10 computer stays the VMware host; do not install an unsupported Splunk release on it.
  2. Call the practice server SPLUNK01. If it is joined to the class domain, its full name is SPLUNK01.cloudseam.tech. A domain join is not required for local Splunk searches.
  3. Keep enough free resources for your chosen release; compare the linked official requirements with your VM before downloading. A tiny CSV lab is not a production sizing recommendation.

What these commands and settings mean

Why this step matters
A separate guest keeps this installation away from your main PC and your domain controllers.

What you should see

You can identify the guest VM, supported OS and available resources.

Expected observation, not recorded output from your environment.
Choose the practice computer · interface reference

Here’s the interface to look for · Splunk Enterprise / Splunk Cloud reference interface

Unaltered official Splunk screenshot. Its tutorial data, counts, dates, app labels or version can differ from this class. This is a partial interface reference, not a screenshot of the CloudSeam lab or evidence that your task succeeded.

This unaltered Splunk documentation image shows related controls, not the result of your lab. Use the written CloudSeam file names, searches and values; original images may show Buttercup Games data, another version, or Splunk Cloud.

Splunk documentation · © Splunk Inc. · original reference ↗This is an interface reference. Follow the written CloudSeam values; names in original images may differ.
Splunk Apps panel: Search & Reporting

Unaltered official Splunk screenshot. Its tutorial data, counts, dates, app labels or version can differ from this class. This is a partial interface reference, not a screenshot of the CloudSeam lab or evidence that your task succeeded.

Best practices

  • Keep practice objects private in the Search & Reporting app. Use a named index and verify results before saving a report or alert.

Avoid these mistakes

  • Pasting SPL into PowerShell instead of the Splunk Search bar.
  • Using Last 24 hours for the fixed-date practice CSV, or importing the same file twice.
Troubleshooting · my screen is different

The search returns no events.

Select All time, check index=sonic_lab and the source filename, then confirm the upload completed and your role can search that index.

A button or setting is missing.

Check your Splunk version, license and role. Setup needs an administrator; scheduling requires scheduling capabilities and an eligible Enterprise license. Do not claim a task worked if the control is unavailable.

YOUR TURN / PRACTICAL EXERCISE

Show what you can do

Write down your guest OS and where the CSV files are saved. Do not record any passwords.

Pass check

You have a supported practice VM, the two CSV files and a trial/license plan.

Knowledge check

Try these before continuing. You can look back and try again.

1. Which product gives this lab its full Search & Reporting interface?

Pick an answer for each question. It’s fine to look back at the lesson.

Finished? Verify this lesson

Check every step, finish the exercise, and pass the knowledge check. Progress is self-reported. Signed-in learners can save it to their connected academy account.

References and a note for instructors

We’ve checked the written steps against the official references below. Real interfaces can change, so compare your version and subscription or license with the lesson before making a change. Original interface references show real controls. Action diagrams are labeled as illustrations; remaining capture gaps use checklists. These pages have been tested, but an instructor still needs to test installation, updates, scans and recovery in a real practice lab.

Core Certified User blueprint ↗Official Enterprise download ↗Supported OS and installation requirements ↗Windows installation ↗Windows service identity for 10.4 ↗Search app interface ↗Lookups ↗Classic dashboards ↗Scheduled alerts ↗