thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Splunk Search Processing Language

The query language used in Splunk to search, filter, transform and visualize machine data.

Definition

SPL searches start with search terms and pipe results through commands such as stats, eval, table, where, rex, timechart, lookup and dedup. Commands are classified as streaming, transforming, generating and others. Efficient searches specify index, sourcetype and time range early.

Example

index=wineventlog EventCode=4625 | stats count by src_ip | where count > 20

Exam tip

Filter as early as possible (index, sourcetype, time) for performance; know stats vs chart vs timechart.

Related terms