Splunk for Security Analysts

Splunk for Security Analysts: Splunk's Search Processing Language, taught against one month of an engineering company's events with several real attacks in them. What SPL is and where it runs, how Splunk stores events, the sourcetypes analysts search, Splunk Enterprise, Splunk Cloud Platform and SPL2, a first search, the practice lab, how the course climbs from basics to mastery, and a six-scenario check of whether it fits you.

Module 1 of Splunk for Security Analysts: how a question becomes an SPL search, the search pipeline and command order, learning an unfamiliar sourcetype, field values and types, missing fields, checking a result, and reading a search you did not write.

Module 2 of Splunk for Security Analysts: how the base search chooses events. Search terms and segments, field values and Boolean logic, wildcards, time ranges, search versus where, addresses and CIDR, fields inside JSON, and negative filters.

Module 3 of Splunk for Security Analysts: what a search does with the events it chose. eval expressions, if and case, text and time functions, table, fields and rename, sort, head and tail, dedup, and presenting a result.

Module 4 of Splunk for Security Analysts: summarizing events into numbers that mean something. stats, counting correctly, distributions and percentiles, conditional statistics, values and list, timechart, chart, xyseries and untable, and the rates and averages that mislead.

Module 5 of Splunk for Security Analysts: bringing data together. Lookups and lookup tables, subsearches and their limits, join and its limits, append and appendcols, multisearch and union, correlating with stats instead of join, and correlating across time.

Module 6 of Splunk for Security Analysts: working inside fields. rex and its sed mode, the regex command, spath and JSON, multivalue fields, makemv, split and mvexpand, multivalue functions, key-value data and decoding.

Module 7 of Splunk for Security Analysts: logic written once and used everywhere. Search macros and macros with arguments, lookup definitions, field aliases and calculated fields, event types and tags, saved searches, foreach and reusable eval patterns.

Module 8 of Splunk for Security Analysts: events in time. bin and span, comparing periods, eventstats baselines, streamstats windows, delta and the previous event, transaction and sessions, first and last per entity, and running totals.

Module 9 of Splunk for Security Analysts: the Common Information Model, data models and datasets, the datamodel command, tstats, summariesonly and acceleration, tstats with by and where, rewriting raw searches for data models, and checking when a data model answers differently.

Module 10 of Splunk for Security Analysts: how a search runs, filtering first, command types and placement, transforming early, limits and truncation, reading and adapting public searches, checking the answer, checking AI-written SPL, and from SPL to SPL2.

One sheet per module of Splunk for Security Analysts, each entry a question, a search that answers it against the sample month, what to read and what the answer does not prove.

Procedures for the problems every SPL user meets: a search that returns nothing, a search that is too slow, and a source nobody has searched before.

The practice lab the course runs in, and how to get a Splunk of your own for the Project: an employer's deployment, Splunk Enterprise on its trial or Free license, or a Splunk Cloud Platform trial.

Six searches from the course that ran cleanly and answered wrongly, each taken step by step to the right answer: a sort's limit, an early head, a missing field, a silent detection, a lookup's default and a ranking.

Six search patterns analysts reuse: first time seen, rare in the population, volume against its own normal, many accounts from one source, regular gaps, and success after failures. Each with a search that runs against the sample month.

Resources for practicing SPL and using it at work: a free-run search console, two guided SPL drills, the detection library, response playbooks, and an open-source DFIR toolkit.

Every command, function, check and limit from Splunk for Security Analysts in one place, organized by the task in front of you and linked back to the section that explains it.

The documentation behind Splunk for Security Analysts, arranged by the question it answers: the language, where searches run and their limits, getting a Splunk to practice on, and published detections.

The Splunk for Security Analysts project: a brief for a library of twenty searches you build on your own Splunk data, each answering a stated question, each checked, with its source's pitfalls and its cost noted, and one taken to the quality of a scheduled search. No submission, no grading.

Splunk for Security Analysts end-of-course exam: twenty tasks, two per teaching module, each answered by writing SPL against the course's sample month and checked on the server.