Skip to content
SOC FluentSpeak SIEM and EDR
Join the waitlist

For Splunk Enterprise and Splunk Cloud Platform · Coming soon

Practise and learn Splunk SPL

SPL, the Search Processing Language, is how you search Splunk. Like KQL, it’s a piped language, where each step passes its results to the next. The Splunk SPL track on SOC Fluent is coming soon.

Get told when it’s readySee what else is coming
SPLUNK · SPL
index=endpoint EventCode=1 earliest=-24h
    ParentImage="*OUTLOOK.EXE"
    (Image="*powershell.exe" OR Image="*cmd.exe")
| table _time host User CommandLine

What it looks like

Index and field names depend on how your Splunk data is set up. These use common Windows and Sysmon names.

Which accounts had the most failed sign-ins in the last 24 hours?
SPLUNK · SPL
index=wineventlog EventCode=4625 earliest=-24h
| stats count AS failures BY user, src
| sort - failures
| head 10
Did anyone run encoded PowerShell this week?
SPLUNK · SPL
index=sysmon EventCode=1 earliest=-7d
    Image="*\\powershell.exe" CommandLine="*-enc*"
| table _time, host, User, CommandLine

Where you’ll use it

  • Splunk EnterpriseSplunk run on your own servers.
  • Splunk Cloud PlatformSplunk as a hosted service.
  • Splunk Enterprise SecuritySplunk’s SIEM app, built on the same searches.

Worth knowing before you start

  • Values in the first part of a search ignore case, so Image="*cmd.exe" also matches CMD.EXE. Field names don’t, so user and User are different fields.
  • | where compares values exactly, so case matters there.
  • sort keeps 10,000 rows unless you write sort 0.
  • Set the time range with earliest= in the search, or with the time picker.

While you wait

Be first to practise Splunk SPL

Join the waitlist and pick Splunk SPL as the language you want to practise first. We’ll tell you when the track is ready.

Join the waitlistSee pricing

Free to join. Students get 50% off at launch.