Splunk Search Head – SPL Tutorial

index=firewall action=blocked

index=firewall action=blocked | stats count by src_ip

index=firewall action=blocked | stats count by src_ip | sort -count | head 10

-- implizites AND -- index=windows EventCode=4625 User=admin

-- explizites AND -- index=windows EventCode=4625 AND User=admin

index=auth (failed OR error) AND NOT src_ip=10.0.0.1

-- Einzelner Index -- index=windows -- Mehrere Indizes (OR-Logik) -- index=windows OR index=linux -- Wildcard -- index=prod_* -- Alle Indizes (vermeiden!) -- index=*

index=windows sourcetype=WinEventLog:Security index=network sourcetype=cisco:asa

-- Methode 1: über metadata (empfohlen) -- | metadata type=indexes | table title, totalCount, recentTime -- Methode 2: über eventcount -- | eventcount summarize=false index=* | dedup index | table index

-- Methode 1: über metadata (schnell, kein Event-Scan) -- | metadata type=sourcetypes index=botsv1 -- Methode 2: über stats (langsamer, liest Events) -- index=botsv1 | stats count by sourcetype

| metadata type=sourcetypes index=* | eval last_seen=strftime(recentTime, "%Y-%m-%d %H:%M:%S") | table index, sourcetype, totalCount, last_seen | sort index

-- Relativ (empfohlen) -- index=windows earliest=-24h latest=now index=windows earliest=-7d@d latest=@d -- Absolut (ISO) -- index=windows earliest="2025-06-01T00:00:00" latest="2025-06-11T23:59:59"

-- Unix-Timestamp → lesbares Datum -- | eval human = strftime(_time, "%Y-%m-%d %H:%M:%S %Z") -- Datum-String → Unix-Timestamp -- | eval ts = strptime(date, "%d/%b/%Y:%H:%M:%S") -- Zeitdifferenz berechnen -- | eval minuten = round((end-start)/60, 2) -- Zeitgruppierung für Trends -- | bin _time span=5m | stats count by _time

-- Wildcard am Ende (effizient) -- process_name=powershell* -- Wildcard in der Mitte (teurer) -- CommandLine=*mimikatz* -- Feld existiert / ist befüllt -- src_ip=* -- Feld nicht vorhanden -- NOT error_code=*

-- String-Konkatenation -- | eval asset=host.":".src_ip -- Bedingte Logik -- | eval severity=if(count>100, "HIGH", "LOW") -- case()-Ausdruck (sauberer als verschachteltes if) -- | eval risk=case( score>80, "Critical", score>50, "Medium", 1==1, "Low" ) -- Coalesce – ersten nicht-null Wert zurückgeben -- | eval user=coalesce(username, email, "anonymous") -- Unix-Zeit zu lesbarem Datum -- | eval human_time=strftime(_time, "%Y-%m-%d %H:%M:%S") -- Datum-String zu Unix-Timestamp -- | eval epoch=strptime(date_field, "%d/%b/%Y:%H:%M:%S") -- Math: Bytes in GB -- | eval gb=bytes/1024/1024/1024 -- Standardabweichung für Ausreisser -- | eventstats avg(rt) as avg_rt, stdev(rt) as stdev_rt | where rt > (avg_rt + 2*stdev_rt)

| eval full_name = first_name . " " . last_name

| eval short = substr(word, 1, 3)

| rex mode=sed field=msg "s/\s+/ /g" | rex mode=sed field=email "s/@/ [at] /"

| replace "localhost" with "127.0.0.1" in host

-- Erst extrahieren, dann vergleichen -- | rex field=MessageStatus "(?<status>\w+)" | eval ok=if(status="delivered", "yes", "no")

-- In einzelne Events aufsplitten -- | mvexpand recipients -- Bestimmten Index aus Multivalue -- | eval first = mvindex(items, 0) -- Mit Trennzeichen joinen -- | eval userlist = mvjoin(users, ", ") -- Multivalue-Felder filtern -- | eval errors = mvfilter(match(msgs, "ERROR"))

-- Feldnamen OHNE Anführungszeichen, KEINE Wildcards -- | where isnotnull(user) AND len(user) > 3 | where like(url, "%/api/%")

-- Strings werden als Literale behandelt, Wildcards erlaubt -- | search user=admin* status!=404

-- != schliesst NULL/leere Felder NICHT aus -- -- NOT schliesst auch leere Felder aus -- status!=500 -- 500er werden gefiltert, NULL bleibt drin NOT status=500 -- auch Events OHNE status-Feld werden gefiltert

index=web | stats avg(rt) as avg_rt, median(rt) as p50_rt, perc95(rt) as p95_rt, perc99(rt) as p99_rt by endpoint

index=web | eventstats avg(rt) as avg_rt, stdev(rt) as stdev_rt | where rt > (avg_rt + 2*stdev_rt)

| stats count, dc(src_ip) as unique_visitors, values(useragent) as ua_list by endpoint

index=network | lookup threat_intel.csv ip as src_ip OUTPUT threat_level, category

| inputlookup employees.csv | search department="IT"

index=web status=500 | stats count by src_ip | where count > 100 | outputlookup suspicious_ips.csv

index=web | transaction session_id maxspan=30m maxpause=5m | where duration > 60 | table session_id, duration, eventcount

| stats min(_time) as start, max(_time) as end, count as events by session_id | eval duration = end - start | where duration > 60

-- Ergebnisse einer Suche als Input für die Hauptsuche -- index=web user=[search index=vpn | dedup user | fields user] | stats count by user

index=main | join type=left user [ search index=hr | stats count by user ]

index=web status=500 | stats count as errors by host | append [ search index=web status=200 | stats count as success by host ]

-- ① Früh filtern: Index + Sourcetype zuerst -- index=web sourcetype="access_log" status=500 statt: index=* | search sourcetype="access_log" -- ② Keine Wildcards am Anfang -- *error ✗ (Full-Scan) error* ✓ (Index-gefiltert) -- ③ fields-Kommando nutzen -- | fields host, status, response_time | stats avg(response_time) by host -- ④ tstats für indizierte Felder (schneller) -- | tstats count where index=web by host, status -- ⑤ Möglichst kurzen Zeitraum wählen -- earliest=-7d statt earliest=-30d -- ⑥ stats statt transaction verwenden -- | stats min(_time) as start by session -- ✓ schnell | transaction session -- ✗ langsam

-- Einfache Extraktion -- | rex field=_raw "user=(?<username>\w+)" -- Mehrere Felder auf einmal -- | rex field=url "\/api\/(?<version>v\d+)\/(?<endpoint>\w+)"

| rex field=_raw max_match=0 "error_code=(?<codes>\d+)"

# IP-Adresse: (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) # E-Mail: (?<email>[\w.+-]+@[\w-]+\.\w+) # UUID: (?<uuid>[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}) # URL-Pfad: (?<path>\/[\w\/.-]+) # Domain aus URL: (?<domain>(?:https?:\/\/)?([\w.-]+)\/)