Set Up Splunk Free With Docker

Splunk ships as an official Docker image, so there is nothing to install by hand. Just make sure Docker is up first.

$ docker --version

A version line back means you are good. On Windows/macOS, make sure Docker Desktop is actually launched (not just installed). Splunk's image is a few GB, so a decent internet connection helps for the first pull.

Why. Everything here runs inside the container — no Splunk install, no dependencies on your host, and a clean uninstall is one docker rm away. That is the whole reason we use Docker for a SIEM lab.

This pulls the official splunk/splunk image and starts a full Splunk Enterprise instance in the background. Pick your own admin password where shown — Splunk requires at least 8 characters.

$ docker run -d -p 8000:8000 --name splunk -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=Changeme123!" splunk/splunk:latest

-d runs it in the background; -p 8000:8000 maps Splunk's web UI to http://localhost:8000; SPLUNK_START_ARGS=--accept-license accepts the licence so the container can start; SPLUNK_PASSWORD sets the admin password. Change Changeme123! to something of your own.

What just happened. You deployed enterprise SIEM software — normally a multi-step install — as one disposable container. First launch runs an internal setup playbook, so it is not ready the instant the command returns. That is what the next step is for.

First start takes a few minutes while Splunk configures itself. Watch the logs until it reports it is up.

$ docker logs -f splunk

Wait for a line like Ansible playbook complete and Splunk is running, then press Ctrl+C to stop tailing (that does not stop Splunk). Now open http://localhost:8000 and sign in as admin with the password you set.

Why watch the logs. A SIEM that is still provisioning refuses logins and looks broken. docker logs is how you tell "still starting" from "actually wrong" — the single most useful habit when standing up any container.

Out of the box you are on a 60-day Enterprise trial. Flip it to the free licence so your lab keeps working indefinitely — this is a click path in the UI, no command.

In Splunk, go to Settings → Licensing, click Change license group, choose Free, save, and restart when prompted (docker restart splunk also does it).

$ docker restart splunk

The trade-off. Splunk Free drops multi-user logins and alerting but keeps full search and up to 500 MB/day of indexing — plenty for learning SPL and building dashboards. Do this now so you are not surprised by an expired trial in two months.

A SIEM is only as interesting as the logs in it. The fastest way to feed it: upload a log file through the UI.

Go to Settings → Add Data → Upload, pick any log file (a system log, a web-server access.log, or Splunk's own tutorial dataset), let Splunk guess the source type, send it to the main index, and finish. If you want a quick synthetic log to play with, generate one from the container itself:

$ docker exec splunk bash -c 'for i in $(seq 1 200); do echo "$(date -u +%FT%TZ) user=user$((RANDOM%5)) action=login status=$([ $((RANDOM%4)) -eq 0 ] && echo failure || echo success) src=10.0.0.$((RANDOM%255))"; done > /tmp/auth.log'

That writes the file inside the container. The browser’s Upload picker reads your host machine, not the container, so copy the file out first:

$ docker cp splunk:/tmp/auth.log ./auth.log

Now in Splunk choose Settings → Add Data → Upload and select auth.log from the folder where you ran that command. You have login events to hunt through.

Two concepts that matter. The index is where data lands; the source type tells Splunk how to parse each line. Get those two right and searching is easy — get them wrong and nothing lines up. Every real SOC onboarding is a fight over exactly these.

Open the Search & Reporting app. SPL reads left to right, piping results from one command to the next — like the shell. Start by seeing everything, set the time picker to All time:

index=main

Now count events by how they turned out — the first real analyst move, turning raw lines into a number:

index=main | stats count by status

Hunt for the failed logins specifically, and see who is generating them:

index=main status=failure | stats count by user src

And plot it over time — the shape of an attack often shows up here before anything else:

index=main status=failure | timechart count

Why this is the payoff. search → stats → timechart is the backbone of nearly every detection you will ever write. Swap in real logs and the same four lines find brute-force attempts, beaconing malware, and misconfigured services. This is the skill the SOC job is testing for.

Your data lives inside the container, so you can stop and restart Splunk without losing your indexes or dashboards.

$ docker stop splunk

Pick up exactly where you left off later with:

$ docker start splunk

When you are truly done and want the space back, remove it entirely:

$ docker rm -f splunk

Good lab hygiene. Keep the container around while you are practising — stopped containers cost nothing but disk. Remove it only when you want a clean slate; the exact same launch command in Step 2 rebuilds it from scratch in minutes.