Splunk SIEM Deployment: Step-by-Step Guide to Forwarding Windows 10 Logs to an Ubuntu Server

Building a home SIEM lab is one of the most practical ways to develop hands-on security skills. In this guide, you’ll set up a fully functional Splunk Enterprise instance on an Ubuntu Server virtual machine and forward real Windows 10 event logs to it — replicating a real-world security operations setup using free tools.

By the end, you’ll have Windows Security and System logs streaming into Splunk in real time, searchable and ready for analysis. Let’s get into it.

Contents

1 — Setting Up the Virtual Network

2 — Installing Splunk Enterprise on Ubuntu Server via CLI

3 — Configuring Splunk Port 9997 to Receive Data

4 — Installing Splunk Universal Forwarder on Windows 10

5 — Setting Up inputs.conf for Windows Event Logs

6 — Verifying the SIEM Connection and Analyzing the Log Stream

Setting up the virtual network

First of all, I will not start with downloading VirtualBox and the Virtual machines. I assume that you already have Windows 10 and Ubuntu server both in your Oracle VirtualBox.

Let’s jump into setting up both of them.

We need to make them communicate with each other. That’s why, in the Network setting, we will set Adapter 1 to the Host-only Adapter, but we need to be careful: when we download Splunk Universal Forwarder on Win 10, we need an internet connection. That’s why, for a short time, we will keep Adapter 1 on Windows 10 attached to NAT

For the Ubuntu Server, it is going to look like this

For Win10, it is going to be like this (for now! Later we will change)

For now, we are ready to download Splunk Enterprise.

Installing Splunk Enterprise on Ubuntu Server via CLI

To download Splunk Enterprise, you need to create an account on Splunk.com → **click here to sign up**

If you already have an account → **click here to log in**

Right after you log in to your account, you can search for the Splunk Enterprise free trial. Here we need to download the one for Linux (.deb) since our server is Ubuntu → **Click here to download Splunk Enterprise for Linux**

We are now on the installation page. On the right side of the site, we see an option labeled “Download via Command Line (wget)”. We will click there and copy the given wget.

It should look like this

Amazing, now we can open our Ubuntu server and start the installation.

Important

Since the native Ubuntu Server CLI doesn’t support direct copy-pasting from the host machine, we will establish an SSH connection from our host terminal using the command ssh username@<Ubuntu_IP>. This allows us to easily copy and run commands throughout the installation.

First, let’s check Ubuntu’s IP

the Ubuntu server’s IP is 192.168.56.104 and the Username is splunk@

Now we need to open our actual machine’s CMD

We actually hack the server!! anyway..

Now we will copy our wget from splunk.com, then paste it here.

Yess we got our first error!

splunk@splunk:~$ wget -O splunk-10.2.3–4d61cf8a5c0c-linux-amd64.deb “https://download.splunk.com/products/splunk/releases/10.2.3/linux/splunk-10.2.3-4d61cf8a5c0c-linux-amd64.deb" — 2026–05–16 12:17:30 — https://download.splunk.com/products/splunk/releases/10.2.3/linux/splunk-10.2.3-4d61cf8a5c0c-linux-amd64.deb Resolving download.splunk.com (download.splunk.com)… failed: Temporary failure in name resolution. wget: unable to resolve host address ‘download.splunk.com’

A better way is to download the Splunk packet to your actual computer, then send it to your Ubuntu Server. How to do that? So go to the downloading page again and download the packet to your computer.

After that, open your PowerShell

We have successfully sent the packet to our Ubuntu Server

Let’s check the server if we have the packet.

After running ls, we saw that we have the packet

Now, to install the package on the server, we need to run;

(to run this, turn back to the CMD where we have already access to our ubuntu server through SSH on our actual machine)

sudo dpkg -i splunk-10.2.3-4d61cf8a5c0c-linux-amd64.deb

We need to wait for 4–5 minutes for our server to unpack Splunk and set up; after that, you will receive the complete message.

Right after that, we will set up our username and password, so the command for that is;

sudo /opt/splunk/bin/splunk start --accept-license --run-as-root

So Our Site is ready!

Basically, at this moment, if I go to my browser and run and *http:/192.168.56.104:8000* on my actual computer, I will see the Splunk login page. Alright, let’s do it!

Remember, we set up our username and password. Now we can use them here and log in to our account

If you can’t open the site and receive an error message such as “this site can’t be reached.”

Then follow the commands. (We have to run it on an Ubuntu server, actually, we are controlling it on our actual machine’s cmd. So no need to open Ubuntu server and type it.)

sudo /opt/splunk/bin/splunk status
sudo /opt/splunk/bin/splunk start

“status” will tell you Splunk is running. “start” will restart Splunk.

Now I will log in.

After logging in, it looks like this.

Right now, we don’t have any logs here, so we are going to listen to our Win10 virtual machine.

Configuring Splunk Port 9997 to Receive Data

First we need to run;

sudo /opt/splunk/bin/splunk enable listen 9997 --run-as-root

This code on our server. This will tell my Ubuntu, “Heyy, listen to the logs coming from 9997 port.”

Next, we will install Splunk Universal Forwarder on Win10

Installing Splunk Universal Forwarder on Windows 10

Until here, everything is great; we have a server that is actively listening to the logs from port 9997. By installing Splunk Universal Forwarder, we will send our Win10 logs through port 9997 to our server.

First step, we need to open the settings of Win10 and make the Network Adapter a NAT. This will allow us to reach the Internet.

After finishing the settings, we need to download the packet → [Click here to open the download page](http://Installing Splunk Universal Forwarder on Windows 10)

After you download, just click it and run it.

let me show you the steps

set it like this

Add a username and password

Don’t add anything here, just click next

it depends on your server IP and port number

Click install and let it do, then click finish

For the next step, we need to open the virtual Win10 PowerShell(as an Administrator), and we need to run an important command.

Setting Up inputs.conf for Windows Event Logs

@'
[WinEventLog://Security]
disabled = 0
index = main

[WinEventLog://System]
disabled = 0
index = main
'@ | Out-File -FilePath "C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf" -Encoding UTF8

Even though the Universal Forwarder is installed and connected to our Ubuntu Server, it doesn’t know which logs to collect by default. To fix this, we need to explicitly tell Splunk to capture the Windows Event Logs.

Then, We need to start the Forwarder and verify that our network pipeline is operating correctly.

! Just be sure you run PowerShell as administrator

Start-Service -Name SplunkForwarder

Get-NetTCPConnection -RemoteAddress <Ubuntu_IP> -RemotePort 9997

We are Almost Done!!

Let’s check last things.

First, is Ubuntu really listening? Run this on the Ubuntu Server

sudo ss -tlpn | grep 9997

Yes, the Ubuntu server is actively listening

On the Win10 side, we can run;

Stop-Process -Name splunkd -Force
Start-Service -Name SplunkForwarder

Get-NetTCPConnection -RemotePort 9997

Don’t forget to make both your Win10 and Ubuntu server on a Host-based Network Adapter.

Verifying the SIEM Connection and Analyzing the Log Stream

Finally We can open our site again and check if we have the Win10 log

Important → if you opened the site and received an error like this;

Don’t worry, just open the Ubuntu server terminal (I mean on your actual machine cuz we already have access to the Ubuntu server there) and run those commands respectively.

sudo truncate -s 0 /var/log/syslog
sudo truncate -s 0 /var/log/kern.log
sudo lvextend -l +100%FREE /dev/mapper/ubuntu--vg-ubuntu--lv
sudo resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

Right after that turn back to your Win10 virtual machine and run this command:

Restart-Service -Name SplunkForwarder
Get-Service -Name SplunkForwarder

First command will restart, the second one will show you that the status is running.

Now refresh the website, and hopefully you’ll see the logs

Finally, whenever you want to run again and see the logs. You first open the server and run

sudo /opt/splunk/bin/splunk start --run-as-root

and on the Win10 side, open PowerShell as administrator and run

Start-Service -Name SplunkForwarder

Thank you so much for taking the time to read through this guide. I hope it helps you seamlessly set up your own security operations laboratory!

If you have any questions, faced any issues during the deployment, or simply want to chat about cybersecurity, engineering, or infrastructure, let’s connect!

• LinkedIn: https://www.linkedin.com/in/fethiocalan/