Splunk SPL � SIEM & Threat Hunting

// What is Splunk?

Splunk is a Security Information and Event Management (SIEM) platform that ingests, indexes, and correlates log data from across an environment � endpoints, servers, firewalls, identity providers, cloud services, and more. SOC analysts use it to search for threats, build detection rules, and investigate alerts.

Data is queried using SPL (Search Processing Language) � a pipeline-based query language similar in concept to Unix pipes. Understanding SPL is a core skill for any blue team analyst working in a Splunk environment.

// SPL Basics

Every SPL search starts with a search command (implicit or explicit) and passes results through a pipeline using the pipe character |. Each command in the pipeline transforms or filters the result set.

index=main sourcetype=WinEventLog EventCode=4625
| stats count by src_ip, user
| sort -count
| head 20

This search: finds failed logins (EventCode 4625) ? counts them grouped by source IP and user ? sorts descending ? shows the top 20.

Search terms

// Search Commands

These are the commands you'll use in almost every search. They filter, transform, and reshape event data flowing through the pipeline.

// Statistical Commands

Statistical commands aggregate data � essential for summarising large volumes of log events and spotting anomalies.

stats

The workhorse aggregation command. Groups events and computes aggregate functions.

index=windows EventCode=4625
| stats count AS failures, dc(user) AS unique_users by src_ip
| where failures > 20
| sort -failures

timechart

Like stats but bucketed by time � ideal for visualising activity over time.

index=firewall action=blocked
| timechart span=1h count by src_ip limit=5

top / rare

top returns the most common values for a field; rare returns the least common � useful for anomaly detection.

index=windows EventCode=4688
| rare process_name limit=20

// Fields & Extraction

Splunk auto-extracts fields from common log formats. For custom or unstructured logs, you extract fields yourself using rex or the field extractor UI.

rex � Regex field extraction

| rex field=_raw "src=(?P<src_ip>\d{1,3}(?:\.\d{1,3}){3})"
| rex field=_raw "dst=(?P<dst_ip>\d{1,3}(?:\.\d{1,3}){3})"

spath � JSON / XML extraction

Extracts fields from structured data like JSON logs (common with cloud logs, API events).

index=cloudtrail
| spath input=_raw path=userIdentity.userName output=user
| spath input=_raw path=sourceIPAddress output=src_ip

Useful default fields

// Eval & Conditional Logic

eval creates or modifies fields using expressions. It's one of the most flexible SPL commands � used for calculations, string manipulation, and conditional logic.

index=windows EventCode=4625
| eval risk = case(
    count > 100, "High",
    count > 30, "Medium",
    count > 10, "Low",
    true(), "Info"
)

// Time & Subsearches

Time modifiers

Time range can be set in the UI or in the search itself using earliest and latest.

Subsearches

A subsearch runs first and feeds its results as a filter into the outer search. Useful for cross-referencing threat intel or joining datasets without a lookup.

index=firewall
    [search index=threatintel | return 100 malicious_ip]
| table _time, src_ip, dst_ip, action

// Threat Hunting Queries

These are ready-to-use hunting queries for common attack techniques. Adjust index names and field names to match your environment.

Brute force / password spray

index=windows EventCode=4625 earliest=-1h
| stats count AS failures, dc(user) AS users_targeted by src_ip
| where failures > 50 OR users_targeted > 10
| sort -failures

Successful login after multiple failures (likely breach)

index=windows EventCode IN (4625, 4624)
| stats count(eval(EventCode=4625)) AS failures,
        count(eval(EventCode=4624)) AS successes by user, src_ip
| where failures > 10 AND successes > 0
| sort -failures

PowerShell encoded command execution

index=windows EventCode=4688 earliest=-24h
| where like(lower(CommandLine), "%-enc%") OR like(lower(CommandLine), "%-encodedcommand%")
| table _time, host, user, CommandLine
| sort -_time

Lateral movement � remote service creation

index=windows EventCode=7045 earliest=-24h
| table _time, host, ServiceName, ImagePath, AccountName
| sort -_time

DCSync attack detection

index=windows EventCode=4662 earliest=-1h
| where like(Properties, "%1131f6aa-9c07-11d1-f79f-00c04fc2dcd2%")
    OR like(Properties, "%1131f6ad-9c07-11d1-f79f-00c04fc2dcd2%")
| where SubjectUserName!="*$"
| table _time, SubjectUserName, SubjectDomainName, host

Beaconing detection � regular outbound connections

index=network earliest=-6h
| timechart span=5m count by dest_ip
| eventstats stdev(count) AS sd, avg(count) AS mean by dest_ip
| where sd < 2 AND mean > 1
| table dest_ip, mean, sd

Rare parent-child process relationships

index=windows EventCode=4688 earliest=-24h
| stats count by ParentProcessName, NewProcessName
| where count < 5
| sort count

// Key Indexes & Sources

Common indexes and sourcetypes you'll encounter in enterprise Splunk deployments.

Windows Event IDs � Quick Reference

// Tips & Best Practices