Splunk SPL

Search Processing Language

A Complete Beginner’s Guide for SOC Analysts

If you’re stepping into a Security Operations Center (SOC) for the first time, Splunk SPL is one of the first tools you’ll be expected to master. Think of SPL as the language you use to ask Splunk questions — “Show me all failed logins in the last hour”, “Which IP addresses sent the most traffic?” or “Are there any signs of brute-force attempts today?”

This guide covers everything from absolute basics to real-world SOC queries. By the end, you’ll be writing your own searches with confidence.

📌 SPL is a pipeline language — just like Linux pipes. You build a query by chaining commands with the | (pipe) symbol, each step transforming the data from the step before it.

🔗 1. How SPL Works — The Pipeline Model

Every SPL query starts with a search (finding events), then passes results through a series of commands to filter, transform, or summarize the data.

index=<your_index> sourcetype=<type> <keywords> earliest=-24h

| command1 arguments

| command2 arguments

| …

Pipeline Rules to Remember

• Everything before the first | is your base search (retrieval phase).

• Each | passes results to the next command.

• Always filter early — use index=, sourcetype=, host=, and time before any |

• Narrowing early = faster queries and less load on Splunk.

TIP The most expensive part of a Splunk query is reading raw data. The more you filter upfront (before any pipe), the faster your search runs.

⏱️ 2. Time Range Modifiers

SOC work is almost always time-bounded. Here are the most common time modifiers:

Command / Syntax

What It Does

earliest=-15m

Last 15 minutes

earliest=-1h latest=now

Last 1 hour

earliest=-24h

Last 24 hours

earliest=-7d

Last 7 days

earliest=-1h@h

Last full hour (snapped)

earliest=@d latest=now

From start of today

index=main sourcetype=windows_security earliest=-1h latest=now

🔍 3. Basic Search & Filtering

3.1 Keyword Search

index=main error

events containing ‘error’

index=main “login failed”

exact phrase match

index=main (error OR fail) NOT success

boolean logic

**index=main host=web***

wildcard (*)

3.2 Field-Based Filtering

Command / Syntax

What It Does

status=404

HTTP 404 errors exactly

status!=200

Anything NOT 200

**src_ip=192.168.1.***

IP range with wildcard

**user=admin***

Users starting with ‘admin’

bytes>5000

Events where bytes > 5000

🧱 4. Core Commands — The Building Blocks

4.1 fields — Keep or Remove Fields

Use fields early to drop what you don’t need — it speeds up your query significantly.

| fields host, src_ip, dest_ip, action, status

| fields — _raw, linecount — minus

(-) removes fields

4.2 table — Display a Clean Table

| table _time, host, src_ip, action, status

4.3 sort — Order Your Results

| sort — _time — newest first (- = descending)

| sort count — ascending by count

| sort — bytes — most bytes first

4.4 head / tail — Limit Results

| head 10 — first 10 events

| tail 5 — last 5 events

4.5 dedup — Remove Duplicates

| dedup src_ip

keep only first per src_ip

| dedup 3 src_ip

keep up to 3 per src_ip

4.6 rename — Rename Fields

| rename src_ip AS source_address, dest_ip AS destination

📊 5. Aggregation — stats, top, rare

5.1 stats — The Most Important Command

stats lets you count, sum, average, and group data. This is what you’ll use the most in SOC investigations.

| stats count

total event count

| stats count by host

count per host

| stats count by src_ip, action

count grouped by two fields

| stats sum(bytes) as total_bytes by src_ip

| stats avg(response_time) by host

| stats values(action) by user

list unique actions per user

| stats dc(src_ip) as unique_ips by host

distinct count

5.2 top / rare — Most & Least Common

| top src_ip

top source IPs (default: 10)

| top limit=20 user

top 20 users

| top limit=5 action by host

| rare user

least common users (useful for threat hunting!)

TIP rare is your threat-hunting friend. Attackers often use uncommon usernames or processes. rare user or rare process_name can surface anomalies fast.

5.3 timechart — Trends Over Time

timechart is great for dashboards and spotting spikes in activity.

| timechart count by host

events over time per host

| timechart span=1h count

1 hour buckets

| timechart span=15m avg(response_time)

⚙️ 6. eval — Create & Transform Fields

eval is one of the most powerful SPL commands. Use it to create new calculated fields, conditional logic, or string manipulation.

Command / Syntax

What It Does

eval total=bytes_in + bytes_out

Arithmetic: add two fields

eval status_type=if(status>=400, “Error”, “OK”)

Conditional (if/else)

eval upper_user=upper(user)

String function: uppercase

eval len=len(uri)

String length

eval gb=bytes/1073741824

Convert bytes to GB

eval with case() — Multiple Conditions

| eval risk=case(

severity=”critical”, “P1 — Immediate”,

severity=”high”, “P2 — Urgent”,

severity=”medium”, “P3 — Monitor”,

true(), “P4 — Low”

)

🔎 7. where — Filtering After Stats

Use where after stats or eval to filter on computed values. It’s like SQL WHERE but applied after aggregation.

index=main | stats count by src_ip | where count > 100

index=main | stats sum(bytes) as total by src_ip | where total > 1000000

index=main | eval duration_mins=duration/60 | where duration_mins > 30

🔬 8. rex — Extract Fields with Regex

rex extracts new fields from raw log text using named capture groups. Very common in SOC when logs don’t have structured fields.

| rex field=_raw “user=(?<username>\S+)”

| rex field=_raw “src=(?<src_addr>\d+.\d+.\d+.\d+)”

| rex field=message “Failed password for (?<failed_user>\S+) from (?<src_ip>\S+)”

TIP (?<fieldname>pattern) is the syntax for a named capture group. Whatever matches pattern gets stored in fieldname as a new field you can use downstream.

🔗 9. transaction — Group Related Events

transaction groups multiple events that belong together, like all events in a single login session, a web request, or an attack sequence.

index=main | transaction src_ip maxspan=5m

index=auth | transaction session_id maxspan=30m maxpause=5m

— Groups events from same src_ip within 5 min window

Command / Syntax

What It Does

maxspan=5m

Maximum total time of the transaction

maxpause=2m

Max gap between events in group

startswith=”login”

Start transaction on this event

endswith=”logout”

End transaction on this event

📋 10. lookup — Enrich Data with Threat Intel

lookup lets you enrich your events with data from a lookup table (CSV file). In SOC, this is used to match IPs against threat intel lists, map usernames to departments, or add asset info.

| lookup threat_intel_ips src_ip OUTPUT threat_category, confidence

| lookup user_info username OUTPUT department, manager, location

| lookup malware_hashes file_hash OUTPUT malware_family, severity

📌 Lookup tables are managed by your Splunk admin. Ask your team what lookup tables are available — common ones in SOC are IP reputation lists, asset inventories, and user directories.

🛡️ 11. Real-World SOC Query Examples

11.1 Brute Force Detection — Failed Logins

Detect users or IPs with excessive failed login attempts:

index=windows_security EventCode=4625 earliest=-1h

| stats count by user, src_ip, host

| where count > 10

| sort — count

| table user, src_ip, host, count

11.2 Top Talkers — High Data Transfer

Identify IPs sending unusually large amounts of traffic (potential data exfiltration):

index=network_traffic earliest=-24h

| stats sum(bytes_out) as total_out by src_ip

| eval gb_sent=round(total_out/1073741824, 2)

| where gb_sent > 1

| sort — gb_sent

| table src_ip, gb_sent

11.3 After-Hours Login Activity

Find logins happening outside business hours — a common indicator of compromise:

index=auth action=success earliest=-24h

| eval hour=strftime(_time, “%H”)

| where hour < 7 OR hour > 19

| stats count by user, src_ip, hour

| sort — count

11.4 New/Rare Processes (Endpoint Threat Hunting)

Surface rarely-seen processes — attackers often use unusual process names:

index=endpoint_logs earliest=-7d

| stats count by process_name

| where count < 5

| sort count

| table process_name, count

11.5 HTTP 500 Errors — Application Health

Track server-side errors over time to spot application attacks or crashes:

index=web sourcetype=access_combined status=500 earliest=-6h

| timechart span=15m count by host

11.6 DNS Exfiltration Indicators

Unusually long DNS queries can indicate DNS tunneling (data exfiltration via DNS):

index=dns earliest=-1h

| eval query_len=len(query)

| where query_len > 50

| stats count, avg(query_len) as avg_len by src_ip

| sort — count

📖 12. Full Command Quick Reference

Command

Purpose

Example

search / base

Retrieve events from index

index=main sourcetype=syslog

fields

Keep or remove fields

| fields host, src_ip

table

Display as table

| table _time, user, action

sort

Order results

| sort — count

head / tail

Limit result count

| head 20

dedup

Remove duplicates

| dedup src_ip

rename

Rename a field

| rename src_ip AS source

stats

Aggregate/summarize

| stats count by host

top / rare

Most/least frequent values

| rare user

timechart

Time-series chart

| timechart span=1h count

eval

Create/transform fields

| eval gb=bytes/1073741824

where

Filter on expressions

| where count > 100

rex

Regex field extraction

| rex “user=(?<u>\S+)”

transaction

Group related events

| transaction src_ip maxspan=5m

lookup

Enrich with external data

| lookup threat_ips src_ip

streamstats

Running statistics

| streamstats count by user

join

Join two datasets

| join src_ip [search index=…]

💡 13. Pro Tips for SOC Analysts

TIP Always start with index=, sourcetype=, host=, and time range BEFORE any pipe. This is the single most impactful performance optimization.

TIP Use | fields early in your pipeline to drop unused fields. Less data to process = faster results.

TIP Build queries incrementally. Start with just index=main | head 100, then add pipes one by one. Debug as you go.

TIP Use the Job Inspector in Splunk Web (Inspect Job button) to see scan count, event count, and time taken — invaluable for optimization.

TIP rare is more useful than top for threat hunting. Attackers stand out by being different, not by being frequent.

TIP Bookmark your most-used queries! Build a personal SPL library in a notepad or Confluence wiki.

🗺️ 14. Your SPL Learning Roadmap

Week 1 — Foundations

• search, fields, table, sort, head, dedup

• Time modifiers: earliest, latest

• Basic filtering: field=value, !=, *, AND/OR/NOT

Week 2 — Aggregation

• stats with count, sum, avg, values, dc

• top and rare

• timechart for trends

Week 3 — Transformation

• eval — conditionals (if, case), math, string functions

• where — post-aggregation filtering

• rename — clean field names

Week 4 — Advanced

• rex — regex extraction from raw logs

• transaction — session grouping

• lookup — threat intelligence enrichment

• streamstats, append, join

📌 Practice daily on your company’s Splunk or use Splunk’s free Boss of the SOC (BOTS) dataset at bots.splunk.com — it’s the best SOC training environment available.

Happy hunting, Shubham — one query at a time!

SPL Beginner’s Guide