Splunk SPL for beginners: index, sourcetype, fields, and the search pipeline

How a search flows

A Splunk search starts with a base search that selects events, usually by index, sourcetype, host, and keywords or field values. Each pipe sends the results into a command that filters, transforms, or formats them, much like a Unix pipeline. The time picker or earliest and latest options limit the window, and narrowing time is the single biggest speed improvement.

Fields are extracted at search time from the raw event. Field names are case-sensitive; values in field=value comparisons are not, unless you use the case function.

First searches

The searches below use the Windows Security log as an example. Put the most selective terms first, filter as early as possible, and only then format output.

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 earliest=-24h
| table _time host Account_Name Source_Network_Address Failure_Reason
| sort - _time

index=wineventlog EventCode=4625 earliest=-24h
| stats count by Account_Name, Source_Network_Address
| where count > 20
| sort - count

Lab: Splunk with the BOTS data

Install the free Splunk trial or Splunk Free in a VM, or use a hosted training environment, and load a public dataset such as Boss of the SOC (BOTS) v1, which includes Windows, web, and network logs from a simulated incident. Start with index=botsv1 | stats count by sourcetype to see what is there. Then answer three questions with SPL: which hosts generated the most failed logons, which source IP made the most web requests, and what the top five user agents were.

index=botsv1 earliest=0 | stats count by sourcetype | sort - count
index=botsv1 sourcetype=stream:http | top limit=5 http_user_agent
index=botsv1 sourcetype=stream:http | stats count by src_ip | sort - count | head 10

Keeping searches fast

Always specify an index. Avoid leading wildcards such as *admin. Prefer stats over transaction where possible. Use fields to drop fields you do not need before heavy commands, and use tstats against accelerated data models for very large searches.

• index=... sourcetype=... first
• Short time ranges while developing
• stats instead of transaction
• No leading wildcards