Detection & response
SPL
Search Processing Language
Splunk's pipe-based search language for filtering, transforming and aggregating indexed events.
SPL begins with a search (index=... sourcetype=... plus terms) and pipes results through commands: stats, eval, where, rex, timechart, tstats. Searches that use tstats over accelerated data models or indexed fields run far faster than raw event searches.
Investigation habits: always set index and a time range, filter before stats, and prefer stats over transaction or join for correlation, since the latter are slow and have result limits that silently truncate. rex extracts fields at search time when parsing is missing.
index=wineventlog (EventCode=4625 OR EventCode=4624) earliest=-24h
| stats count(eval(EventCode=4625)) AS failures
count(eval(EventCode=4624)) AS successes
dc(user) AS users BY src_ip
| where failures > 20 AND successes > 0
| sort - failures