Splunk Search Head – SPL Tutorial

index=firewall action=blocked

index=firewall action=blocked | stats count by src_ip

index=firewall action=blocked | stats count by src_ip | sort -count | head 10

-- implizites AND -- index=windows EventCode=4625 User=admin

-- explizites AND -- index=windows EventCode=4625 AND User=admin

index=auth (failed OR error) AND NOT src_ip=10.0.0.1

-- Einzelner Index -- index=windows -- Mehrere Indizes (OR-Logik) -- index=windows OR index=linux -- Wildcard -- index=prod_* -- Alle Indizes (vermeiden!) -- index=*

index=windows sourcetype=WinEventLog:Security index=network sourcetype=cisco:asa

-- Methode 1: über tstats (empfohlen, schnell) -- | tstats count as totalCount, max(_time) as recentTime where index=* by index | rename index as title | table title, totalCount, recentTime -- Methode 2: über eventcount -- | eventcount summarize=false index=* | dedup index | table index

-- Methode 1: über metadata (schnell, kein Event-Scan) -- | metadata type=sourcetypes index=botsv1 -- Methode 2: über stats (langsamer, liest Events) -- index=botsv1 | stats count by sourcetype

-- tstats liefert index UND sourcetype zurück -- | tstats count as totalCount, max(_time) as recentTime where index=* by index, sourcetype | eval last_seen=strftime(recentTime, "%Y-%m-%d %H:%M:%S") | table index, sourcetype, totalCount, last_seen | sort index

-- Relativ (empfohlen) -- index=windows earliest=-24h latest=now index=windows earliest=-7d@d latest=@d -- Absolut (Splunk-Format MM/DD/YYYY:HH:MM:SS) -- index=windows earliest="06/01/2025:00:00:00" latest="06/11/2025:23:59:59"

-- Unix-Timestamp → lesbares Datum -- | eval human = strftime(_time, "%Y-%m-%d %H:%M:%S %Z") -- Datum-String → Unix-Timestamp -- | eval ts = strptime(date, "%d/%b/%Y:%H:%M:%S") -- Zeitdifferenz berechnen -- | eval minuten = round((end-start)/60, 2) -- Zeitgruppierung für Trends -- | bin _time span=5m | stats count by _time

-- Wildcard am Ende (effizient) -- process_name=powershell* -- Wildcard in der Mitte (teurer) -- CommandLine=*mimikatz* -- Feld existiert / ist befüllt -- src_ip=* -- Feld nicht vorhanden -- NOT error_code=*

-- String-Konkatenation -- | eval asset=host.":".src_ip -- Bedingte Logik -- | eval severity=if(count>100, "HIGH", "LOW") -- case()-Ausdruck (sauberer als verschachteltes if) -- | eval risk=case( score>80, "Critical", score>50, "Medium", 1==1, "Low" ) -- Coalesce – ersten nicht-null Wert zurückgeben -- | eval user=coalesce(username, email, "anonymous") -- Unix-Zeit zu lesbarem Datum -- | eval human_time=strftime(_time, "%Y-%m-%d %H:%M:%S") -- Datum-String zu Unix-Timestamp -- | eval epoch=strptime(date_field, "%d/%b/%Y:%H:%M:%S") -- Math: Bytes in GB -- | eval gb=bytes/1024/1024/1024 -- Standardabweichung für Ausreisser -- | eventstats avg(rt) as avg_rt, stdev(rt) as stdev_rt | where rt > (avg_rt + 2*stdev_rt)

| eval full_name = first_name . " " . last_name

| eval short = substr(word, 1, 3)

| rex mode=sed field=msg "s/\s+/ /g" | rex mode=sed field=email "s/@/ [at] /"

| replace "localhost" with "127.0.0.1" in host

-- Erst extrahieren, dann vergleichen -- | rex field=MessageStatus "(?<status>\w+)" | eval ok=if(status="delivered", "yes", "no")

-- In einzelne Events aufsplitten -- | mvexpand recipients -- Bestimmten Index aus Multivalue -- | eval first = mvindex(items, 0) -- Mit Trennzeichen joinen -- | eval userlist = mvjoin(users, ", ") -- Multivalue-Felder filtern -- | eval errors = mvfilter(match(msgs, "ERROR"))

-- Feldnamen OHNE Anführungszeichen, KEINE Wildcards -- | where isnotnull(user) AND len(user) > 3 | where like(url, "%/api/%")

-- Strings werden als Literale behandelt, Wildcards erlaubt -- | search user=admin* status!=404

-- != schliesst NULL/leere Felder NICHT aus -- -- NOT schliesst auch leere Felder aus -- status!=500 -- 500er werden gefiltert, NULL bleibt drin NOT status=500 -- auch Events OHNE status-Feld werden gefiltert

index=web | stats avg(rt) as avg_rt, median(rt) as p50_rt, perc95(rt) as p95_rt, perc99(rt) as p99_rt by endpoint

index=web | eventstats avg(rt) as avg_rt, stdev(rt) as stdev_rt | where rt > (avg_rt + 2*stdev_rt)

| stats count, dc(src_ip) as unique_visitors, values(useragent) as ua_list by endpoint

index=network | lookup threat_intel.csv ip as src_ip OUTPUT threat_level, category

| inputlookup employees.csv | search department="IT"

index=web status=500 | stats count by src_ip | where count > 100 | outputlookup suspicious_ips.csv

index=web | transaction session_id maxspan=30m maxpause=5m | where duration > 60 | table session_id, duration, eventcount

| stats min(_time) as start, max(_time) as end, count as events by session_id | eval duration = end - start | where duration > 60

-- Ergebnisse einer Suche als Input für die Hauptsuche -- index=web user=[search index=vpn | dedup user | fields user] | stats count by user

index=main | join type=left user [ search index=hr | stats count by user ]

index=web status=500 | stats count as errors by host | append [ search index=web status=200 | stats count as success by host ]

-- ① Früh filtern: Index + Sourcetype zuerst -- index=web sourcetype="access_log" status=500 statt: index=* | search sourcetype="access_log" -- ② Keine Wildcards am Anfang -- *error ✗ (Full-Scan) error* ✓ (Index-gefiltert) -- ③ fields-Kommando nutzen -- | fields host, status, response_time | stats avg(response_time) by host -- ④ tstats für indizierte Felder (schneller) -- | tstats count where index=web by host, status -- ⑤ Möglichst kurzen Zeitraum wählen -- earliest=-7d statt earliest=-30d -- ⑥ stats statt transaction verwenden -- | stats min(_time) as start by session -- ✓ schnell | transaction session -- ✗ langsam

-- Einfache Extraktion -- | rex field=_raw "user=(?<username>\w+)" -- Mehrere Felder auf einmal -- | rex field=url "\/api\/(?<version>v\d+)\/(?<endpoint>\w+)"

| rex field=_raw max_match=0 "error_code=(?<codes>\d+)"

# IP-Adresse: (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) # E-Mail: (?<email>[\w.+-]+@[\w-]+\.\w+) # UUID: (?<uuid>[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}) # URL-Pfad: (?<path>\/[\w\/.-]+) # Domain aus URL: (?<domain>(?:https?:\/\/)?([\w.-]+)\/)

index=api sourcetype=json | spath output=user path=event.actor.username | spath output=action path=event.action | table _time, user, action

| spath input=payload -- danach sind alle Keys als Felder verfügbar --

| spath path=event.tags{} output=tags | mvexpand tags -- Einzelnes Array-Element (0-basiert) -- | spath path=event.ips{0} output=first_ip

index=network | where cidrmatch("10.0.0.0/8", src_ip) -- interne vs. externe IPs klassifizieren -- | eval zone=if(cidrmatch("10.0.0.0/8", src_ip), "intern", "extern")

index=network action=blocked | iplocation src_ip | stats count by Country, City | sort -count

| iplocation src_ip | geostats count

index=auth action=success | iplocation src_ip | stats dc(Country) as laender values(Country) as liste by user | where laender > 1

| eval clear = urldecode(request_uri)

index=edr CommandLine=*-enc* | rex field=CommandLine "-[eE]nc(?:odedCommand)?\s+(?<b64>[A-Za-z0-9+/=]+)" | table _time, host, user, b64

-- benötigt Add-on "URL Toolbox" (SplunkBase) -- | eval decoded = base64decode(b64) -- PowerShell nutzt UTF-16LE → NUL-Bytes entfernen -- | rex mode=sed field=decoded "s/\x00//g"

| tstats summariesonly=true count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src

| datamodel Network_Traffic All_Traffic search | stats sum(All_Traffic.bytes) as bytes by All_Traffic.dest

| datamodel

| rest /services/data/indexes | table title, totalEventCount, currentDBSizeMB, maxTime, minTime | sort -currentDBSizeMB

| rest /services/search/jobs | search isDone=0 | table author, label, runDuration, sid

| rest /services/saved/searches | search is_scheduled=1 disabled=0 | table title, cron_schedule, search

| makeresults count=5 | streamstats count as row | eval status = if(row%2==0, "ok", "fail")

| foreach *_bytes [ eval <<FIELD>>_mb = '<<FIELD>>'/1024/1024 ]

| stats count by host, status | addtotals row=true col=true labelfield=host

index=neu | fieldsummary | table field, count, distinct_count, values

| stats count by status | transpose

index=windows | `windows_logons` -- expandiert z.B. zu: EventCode=4624 OR EventCode=4625 --

-- Definition: failed_logins(1) => src=$src$ EventCode=4625 -- index=windows | `failed_logins(10.0.0.5)`

| rest /servicesNS/-/-/admin/macros | table title, definition, args

index=windows EventCode=4625 | stats count by src_ip | where count > 20 -- Alert-Trigger: "Number of Results > 0" --

*/5 * * * * -- alle 5 Minuten 0 * * * * -- jede volle Stunde 0 6 * * 1 -- montags 06:00 Uhr