Splunk Fundamental

Event

An event is:

One log entry

Examples:

Failed password for invalid user fakeuser

SOC-LAB-DAY2-TEST

Every line Splunk indexes is generally an event.

Host

Host answers:

Which machine created this event?

Examples:

ubuntu-server
kali
windows
pfsense

Current Lab:

Hosts = 1

ubuntu-server

Memory Trick:

Host = Machine

Source

Source answers:

Which file did this event come from?

Examples:

/var/log/auth.log
/var/log/syslog
/var/log/apache2/access.log

Current Lab:

/var/log/auth.log
/var/log/syslog

Memory Trick:

Source = File

Sourcetype

Sourcetype answers:

What kind of log is this?

Examples:

linux_secure
syslog
apache

Current Lab:

linux_secure
syslog

Memory Trick:

Sourcetype = Type of log

How is Apache a log I don’t understand it?

You don't know what Apache is.

What is Apache?

Apache is a program.

Just like:

• Chrome = web browser

• Discord = chat app

• Apache = web server

A web server's job is to host websites.

For example, when you visit a website:

www.example.com

there might be an Apache server in the background sending you the webpage.

Apache creates log files

Apache keeps records of who visits the website.

Example:

Bob visited the homepage.
Sarah visited the login page.
John got a 404 error.

It writes those records into a file called:

access.log

In Splunk

Splunk looks at access.log and says:

So Splunk labels it:

sourcetype=apache

The easiest way to remember it for your lab

Don't worry about the technical details.

Just memorize:

For the lab, when you see:

/var/log/apache2/access.log

think:

👉 Web server log

👉 Apache

👉 sourcetype = apache

Let me check one thing:

When your lab asks for sourcetype, are they giving you a filename like:

/var/log/apache2/access.log

and asking you to pick the sourcetype?

Or are they showing actual log entries and asking you to identify them?

Those are learned differently.

no but the sourcetype would be apache2 not access.log right

AH! Now I see where the confusion is.

You're mixing up source and sourcetype.

Take this path:

/var/log/apache2/access.log

Break it apart:

apache2  = folder
access.log = file

Neither one automatically equals the sourcetype.

In many Splunk labs, they map like this:

Source: /var/log/apache2/access.log
Sourcetype: apache

Why not apache2?

Because apache2 is just the folder name. Splunk cares about the format of the log data, not the folder name.

Think about it:

/var/log/apache2/access.log

could be moved to

/home/zakari/logs/access.log

and it would still contain Apache web server logs.

The log format didn't change.

So:

• Source = where the file is located
  
  

• Sourcetype = what kind of log data is inside
  
  

For your Splunk training, if you see:

/var/log/apache2/access.log

the answers are usually:

Source = /var/log/apache2/access.log
Sourcetype = apache

EVEN BETTER EXPLANATION

but how do we know that Source: /var/log/apache2/access.log Sourcetype: apache the source type is apache is it because apache2 is in the source?

Excellent question.

And the answer is:

No. Not necessarily.

This is a very important distinction.

Let's look at this:

/var/log/apache2/access.log

From the filename, we can guess it's an Apache log.

But Splunk does not automatically know that:

Source = /var/log/apache2/access.log

therefore

Sourcetype = apache

Remember when we configured auth.log?

We literally told Splunk:

[monitor:///var/log/auth.log]
disabled = 0
index = main
sourcetype = linux_secure

Notice this line:

sourcetype = linux_secure

We assigned the sourcetype ourselves.

If we added Apache logs, we might configure:

[monitor:///var/log/apache2/access.log]
disabled = 0
index = main
sourcetype = apache

Now Splunk knows:

Source:
/var/log/apache2/access.log

Sourcetype:
apache

because we told it so.

Think of it like a label

The source is the file:

/var/log/apache2/access.log

The sourcetype is the label attached to the file:

apache

Splunk doesn't magically know the label.

Some sourcetypes are auto-detected, but many are manually assigned.

Quick Quiz

Suppose I configure:

[monitor:///var/log/apache2/access.log]
sourcetype = banana

Question:

What would Splunk show?

Source = ?

Sourcetype = ?

Take your best guess. This is the question that makes the difference click. 😎

source = var/log/apache2/access.log]
sourcetype = banana

Host:
ubuntu-server

Source:
/var/log/apache2/access.log

Sourcetype:
apache

Tell me:

1. 
   Which machine generated the event?
   
   

2. 
   Which file generated the event?
   
   

3. 
   What type of log is it?
   
   

Answer in full sentences.

If you can answer that without looking at your notes, you've genuinely learned the concept instead of memorizing it. 🔥

1. Ubuntu-Server
2. /var/log/apache2/access.log
3. apache

Almost! You got 1 and 2 correct.

1. Which machine generated the event?

ubuntu-server

✅ Correct

2. Which file generated the event?

/var/log/apache2/access.log

✅ Correct

3. What type of log is it?

You answered:

apache

The example said:

Sourcetype:
apache

So the answer is:

apache

Example Breakdown

Failed SSH Login

Host:
ubuntu-server

Source:
/var/log/auth.log

Sourcetype:
linux_secure

Apache Web Request

Host:
ubuntu-server

Source:
/var/log/apache2/access.log

Sourcetype:
apache

Count

Count answers:

How many events matched?

Example:

source="/var/log/auth.log"
| stats count

Possible Result:

count = 31

Meaning:

31 events matched the search

stats count

Basic

| stats count

Translation:

Count all matching events

By Host

| stats count by host

Translation:

Count events per machine

Example:

ubuntu-server    31

By Source

| stats count by source

Translation:

Count events per log file

Example:

/var/log/auth.log    31

By Sourcetype

| stats count by sourcetype

Translation:

Count events per log type

Example:

linux_secure    31

top Command

Example

| top sourcetype

Translation:

Show the most common sourcetypes

Example:

linux_secure    31    100%

Meaning:

31 events belonged to linux_secure

Real Searches Learned Today

Count Auth Events

source="/var/log/auth.log"
| stats count

Translation:

How many auth.log events exist?

Count By Host

source="/var/log/auth.log"
| stats count by host

Translation:

How many auth.log events came from each machine?

Count By Source

source="/var/log/auth.log"
| stats count by source

Translation:

How many auth.log events came from each log file?

Count By Sourcetype

source="/var/log/auth.log"
| stats count by sourcetype

Translation:

How many auth.log events belong to each log type?

Detection Workflow

Today you completed:

Kali
 ↓
SSH Attack
 ↓
Ubuntu auth.log
 ↓
Splunk Ingestion
 ↓
Splunk Search
 ↓
Detection

This is a real SOC workflow.

SSH Detection Evidence

Generated Attack:

ssh fakeuser@192.168.10.103

Evidence Found:

Invalid user fakeuser
Failed password for invalid user fakeuser
Connection closed

Attacker:

192.168.10.104

Target:

192.168.10.103

Concepts To Review Before Next Session

You should be able to explain:

1

What is an Event?

Answer:

One log entry

2

What is a Host?

Answer:

The machine that created the event

3

What is a Source?

Answer:

The file that generated the event

4

What is a Sourcetype?

Answer:

The type/category of log

5

What does stats count do?

Answer:

Counts matching events

6

What does by host mean?

Answer:

Group results by machine

7

What does by source mean?

Answer:

Group results by log file

8

What does by sourcetype mean?

Answer:

Group results by type of log