A Docker-based lab for practicing with Splunk: log analysis, SPL queries, dashboards, and detection on continuously generated fake malicious events (port scans, brute force, web attacks, C2 beacons).
Works the same on Windows, macOS, and Linux — the only requirement is Docker.
- Docker Desktop (Windows/macOS) or Docker Engine + Compose plugin (Linux)
- At least 4 GB of free RAM for Docker
- Free ports on the host:
8000,8080,8088,2222
| Service | What it does | Host port |
|---|---|---|
splunk |
Splunk Enterprise instance, auto-indexes all lab logs | 8000, 8088, 9997 |
nginx |
"Victim" webserver generating real access logs | 8080 |
cowrie |
SSH/Telnet honeypot — collects real attacks if exposed publicly | 2222 |
generator |
Python script generating fake malicious events on a loop | - |
The generator produces: port scans, SSH/RDP brute force attempts, web attacks (SQLi, XSS, path traversal), and C2 beacon traffic.
- URL: http://localhost:8000
- Username:
admin - Password:
Sp1unkLab!2026(set indocker-compose.yml, change it freely before first launch)
After logging into Splunk, start running these queries.
You start with the 60-day Enterprise trial (all features included). Once it expires, switch to the Splunk Free license (no expiration, 500 MB/day, no multi-user auth or scheduled alerting) from Settings > Licensing in Splunk Web — more than enough to keep using this lab afterward.
This project is licensed under the MIT License — free to use, modify, and share, with no warranty. MIT is a good fit here since the repo is just configuration and scripts (Docker Compose, a Python generator, Splunk config files) with no dependencies that require a different license.