Splunk Search Commands for Beginners: SPL with Security Examples

Splunk's Search Processing Language (SPL) is how analysts ask questions of their logs. You do not need to learn all of it. A dozen commands cover most daily SOC work. This guide explains them with security examples you can try on a free Splunk instance in your own lab. Field names depend on how your data is collected, so adjust them to match yours.

How a Search Is Built

A search starts by choosing data, then passes the results through commands separated by the pipe character "|", each one shaping the output further. Always narrow by index, source type and time range first; it makes searches faster and more accurate.

Choose the Data

"index=wineventlog EventCode=4625" returns failed Windows logons from the index named wineventlog. Add more terms to narrow it, and use the time picker to set the period.

Count with Stats

"index=wineventlog EventCode=4625 | stats count by Account_Name, src_ip" counts failed logons per account and source. Add "| sort - count" to see the largest first. stats is the command you will use most: count, distinct counts (dc), sums, averages, earliest and latest times.

Filter Results with Where

"... | stats count by src_ip | where count > 20" keeps only sources with more than 20 failures, a simple brute-force check. Thresholds like this need tuning to your environment.

Show What Matters with Table

"index=wineventlog EventCode=7045 | table _time, host, Service_Name, Service_File_Name" lists newly installed services with only the fields you need, a quick persistence check.

Create Fields with Eval and Rex

• eval calculates a new field, for example the length of a command line: "| eval cmd_len=len(CommandLine)", useful for spotting very long, encoded commands
• rex extracts a field with a regular expression when Splunk has not parsed it

See Activity Over Time with Timechart

"index=wineventlog EventCode=4625 | timechart span=1h count" shows failed logons per hour. Spikes stand out at a glance and make good dashboard panels.

Find the Unusual with Rare and Top

"index=sysmon EventCode=1 | rare limit=20 Image" lists the least common programs run across your machines. Rare is not the same as malicious, but it is a good place to start a hunt; see what is threat hunting.

Turn Searches into Alerts

A search that reliably finds something bad can be saved as an alert that runs on a schedule. Document what it detects, the threshold and what the analyst should do when it fires. Mapping it to MITRE ATT&CK tells everyone what it covers.

Practice with Good Data

Searches are only as good as the logs. Learn which Windows event IDs matter, add Sysmon, and generate activity in your lab to search for. Our SOC analyst, Splunk, Wazuh and DFIR course teaches SPL through investigations, and our Splunk vs Wazuh guide compares the two tools.