🌐 Splunk Apache Log Visualizer

A cybersecurity project focused on Apache web server log analysis using Splunk dashboards.
This lab demonstrates how to monitor web requests, analyze response patterns, detect client/server errors, and visualize hits from different countries.

---

🎯 Objective

To build a Splunk dashboard that provides clear insights into Apache web traffic — helping identify trends, request sources, and possible anomalies.

---

🧩 Lab Setup

• Tool: Splunk Enterprise
• Dataset: apache_logs.json
• Host: kali
• Sourcetype: _json

---

⚙️ Task 0: Setting up Time Range

🕒 Add Time Range Input

1. Go to Edit Dashboard → Add Input → Select Time
2. Set Label: Time Range
3. Set Token: time_range
4. Add a Submit button
5. Use time_range in every panel for consistent filtering

---

📊 Task 1: Apache Traffic Overview

Goal: Get a quick overview of how the web server is performing.

1️⃣ Total Web Requests

source="apache_logs.json" host="kali" sourcetype="_json"
| stats count as "Total Web Requests"

2️⃣ Successful Responses (HTTP 200)

source="apache_logs.json" host="kali" sourcetype="_json" method=GET status=200
| stats count as "Successful Response"

3️⃣ Client Errors (HTTP 4xx)

source="apache_logs.json" host="kali" sourcetype="_json"
| where status>=400 and status<500
| stats count as "Client Errors"

4️⃣ Server Errors (HTTP 5xx)

source="apache_logs.json" host="kali" sourcetype="_json"
| where status>=500 and status<600
| stats count as "Server Errors"

---

📈 Task 2: Request & Source Analysis

Goal: Understand which pages are most active and where requests are coming from.

1️⃣ Top Requested URIs

source="apache_logs.json" host="kali" sourcetype="_json"
| stats count as "Hits" by uri

2️⃣ Requests by IP Address

source="apache_logs.json" host="kali" sourcetype="_json"
| stats count as IP by ip

---

🌍 Task 3: Geo-Location Analysis

Requests by Country (Choropleth Map)

source="apache_logs.json" host="kali" sourcetype="_json" method=GET
| table ip
| iplocation ip
| stats count by Country
| geom geo_countries featureIdField="Country"

---

🖼 Dashboard Screenshots

---

🙌 Acknowledgment

Special thanks to Rajneesh Gupta for the dataset and guidance.

---

🏁 Conclusion

This project helped me:

• Visualize Apache web server activity using Splunk
• Detect HTTP errors and request trends
• Map client IPs to their geographical origins

---

🔖 Tags

#Splunk #CyberSecurity #SIEM #ApacheLogs #SOC #WebSecurity #LearningByDoing