Lion Cipher Lab
Search and analyze logs with Splunk SPL
- SOC Analyst / Blue Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A running SIEM full of logs is worthless until you can ask it questions, and in Splunk you ask with SPL, the Search Processing Language. SPL is the daily instrument of a SOC analyst: every triage, every hunt, every dashboard panel, and every detection rule is an SPL search underneath. The core idea is small and transfers everywhere — start with search terms to pull the right events, then pipe them through commands that shape, summarize, and filter until only the answer is left. Learn that pipeline on sample data you control and you can go from a pile of logs to "which source address is…
What you'll learn
- reading the SPL pipeline model (search terms then a chain of commands joined by pipes)
- running a basic search and scoping it with a time range
- picking out fields with the fields and table commands
- summarizing events with stats count by, top, and timechart
- filtering results with search versus where
- building a simple detection search (failed logins by source, spikes over time)
- saving a search so it can be re-run or turned into an alert
Steps in this lab
- The one idea behind SPL: search, then pipe
- Your first search, scoped to a time range
- See the fields, then keep only the ones you want
- Count and summarize with stats
- Rank with top, and watch time with timechart
- Filter twice: search early, where late
- Build a real detection, then save it
- What you can now do, and where to point it next