Introduction
We covered the basic fundamentals of Splunk for beginners. We explored data collection through different methods including but not limited to manual upload. This was part of TryHackMe Splunk: Basics
Splunk Components
Splunk Forwarder
Splunk Forwarder is a lightweight agent installed on the endpoint intended to be monitored, and its main task is to collect the data and send it to the Splunk instance. It does not affect the endpoint’s performance as it takes very few resources to process. Some of the key data sources are:
- Web server generating web traffic.
- Windows machine generating Windows Event Logs, PowerShell, and Sysmon data.
- Linux host generating host-centric logs.
- Database generating DB connection requests, responses, and errors.
Splunk Indexer
Splunk Indexer plays the main role in processing the data it receives from forwarders. It takes the data, normalizes it into field-value pairs, determines the datatype of the data, and stores them as events. Processed data is easy to search and analyze.
Search Head
Splunk Search Head is the place within the Search & Reporting App where users can search the indexed logs . When the user searches for a term or uses a Search language known as Splunk Search Processing Language, the request is sent to the indexer and the relevant events are returned in the form of field-value pairs.
Challenge Answers
Upload the data attached to this task and create an index “VPN_Logs”. How many events are present in the log file?
How many log events by the user Maleena are captured?
What is the number of events that originated from all countries except France?
How many VPN Events were observed by the IP 107.3.206.58?