Splunk online course

Splunk Search Rules and Basic SPL Syntax

Learn Splunk search terms, phrases, Boolean logic, pipelines, sort, and table commands with beginner-friendly SPL examples.

Splunk is a platform for searching, analyzing, and reporting on machine-generated and other indexed data. A search retrieves events from that indexed data and displays the events or processed results that match your criteria.

In Splunk, the primary workspace for searching is the Search app. Enter a search in the search bar, choose an appropriate time range, and run it to inspect matching events and results. Splunk uses Search Processing Language (SPL) to search, filter, transform, and present data.

How Splunk searching works

A Splunk event is an individual piece of indexed data, such as a log message, Windows event, application record, or network observation. A search starts by identifying events that match text or field conditions. SPL commands can then process those matching events.

A simple search can contain only a term:

error

Splunk searches the selected time range for events that match the term. The Search app then displays the matching events, commonly with information such as event time, host, source, and the raw event text.

Search terms

A search term is a word or value used to match events. For example, the following search looks for events containing the word error:

error

Ordinary unquoted search terms are generally case-insensitive, so a search for error can match the same word written with different capitalization. A search can contain more than one term:

failed login

Unquoted terms narrow the results. The more matching conditions you add, the fewer events are likely to satisfy the search. The exact matching behavior can also depend on how data was indexed and which fields contain the text, but the basic rule for ordinary terms is that the terms are treated as required conditions.

Implicit AND behavior

Spaces between ordinary search terms imply an AND relationship. You do not need to type AND between them:

failed login

This is equivalent in intent to:

failed AND login

An event must satisfy both conditions to match. An event containing only failed or only login does not satisfy the complete implied-AND search.

Implicit AND is useful when narrowing an investigation. For example, firewall denied searches for events that contain both terms, while firewall denied outbound adds a third required term.

Exact phrase searches

A phrase search looks for consecutive words in a specific order. Put the complete phrase inside double quotation marks:

"failed login"

This is different from:

failed login

The unquoted version uses two separate terms connected by implicit AND. The words can occur separately in the event. The quoted version searches for the expression as a phrase, preserving word order and adjacency. Thus, an event containing login failed does not match the phrase "failed login" merely because it contains the same two words in reverse order.

Boolean search logic

Boolean logic combines or excludes search conditions. The main operators are AND, OR, and NOT.

AND

AND requires all connected conditions to be true. Between ordinary space-separated terms, AND is implied:

failed login

You can also write it explicitly when making a Boolean expression clearer:

failed AND login

OR

OR matches events that satisfy at least one alternative:

error OR warning

This returns events containing error, events containing warning, and events containing both. OR generally produces a broader result set than requiring both terms with AND.

NOT

NOT excludes events that match the following term or condition:

failed NOT test

This search looks for failed events while excluding events containing test. NOT is useful for removing a known source of noise, but make the condition specific enough that you do not accidentally remove useful events.

Grouping Boolean conditions

Use parentheses to group alternatives and exclusions in a complex search:

(error OR warning) NOT test

First, the grouped condition accepts an event containing either error or warning. The NOT condition then removes events containing test. Parentheses make the intended logic explicit and help prevent an expression from being interpreted differently than intended.

The basic SPL search pipeline

An SPL search can begin with search criteria and continue with one or more pipe-separated commands. The pipe character, |, passes the results of one stage to the next:

<base search> | <command> | <command>

The first part identifies the events to process. Each later command operates on the results produced by the preceding stage. This sequence is called a search pipeline.

failed login | sort -_time | table _time host user

In this example, Splunk first finds events matching failed login, then sorts those results by time in descending order, and finally displays only the selected fields as columns.

Keep the initial search as specific as practical. A focused base search makes the later pipeline easier to understand and can reduce the amount of data subsequent commands must process.

Sorting results with sort

The sort command orders result rows by one or more fields. Its introductory syntax is:

| sort [ + | - ] <field>

• A leading minus sign, such as -_time, requests descending order.
• A leading plus sign, such as +host, requests ascending order.
• No sign uses ascending order for the basic form.

Examples:

failed login | sort -_time

This places the newest matching events first when the result time is represented by _time.

failed login | sort host

This orders results by host in ascending order.

failed login | sort -attempts

This orders results by the numeric or sortable field attempts in descending order. The field must be present in the results for the sort to provide the expected ordering.

Formatting output with table

The table command creates a focused tabular result set. It selects which fields appear and controls their column order:

| table <field1> <field2> ...

For example:

failed login | table _time host user

The output contains columns named _time, host, and user, in that order. Fields not listed are omitted from the displayed table. This is useful for readable reports and focused investigation output.

Combine sort and table to produce a concise investigation view:

failed login | sort -_time | table _time host user source

The command order matters: sorting occurs before the selected fields are presented. If a later command needs a field, do not remove or hide that field before the command uses it.

Practical search progression

1. Start with one term: error finds events containing one concept.
2. Add a required term: failed login narrows results through implicit AND.
3. Require an exact expression: "failed login" preserves word order and adjacency.
4. Allow alternatives: error OR warning matches either event type.
5. Remove noise: failed NOT test excludes events containing the unwanted term.
6. Group complex logic: (error OR warning) NOT test makes the alternatives and exclusion explicit.
7. Process the results: use a pipeline such as | sort -_time | table _time host user.

Troubleshooting common search problems

Words match separately instead of as an exact expression

Cause: The words were entered as separate unquoted terms.

Resolution: Put the complete expression inside double quotation marks:

"failed login"

Several words return fewer events than expected

Cause: Space-separated terms use an implied AND, so every term must match.

Resolution: Use OR when either alternative should be accepted:

error OR warning

Unwanted events appear in the results

Cause: The search does not contain an exclusion condition.

Resolution: Add NOT followed by the unwanted term or a grouped condition:

failed NOT test

A complex Boolean search behaves unexpectedly

Cause: Alternatives and exclusions are not grouped clearly.

Resolution: Use parentheses to state the intended logic:

(error OR warning) NOT test

Results are difficult to review

Cause: The results are unsorted or contain more fields than needed.

Resolution: Use sort to order rows and table to show only relevant fields:

failed login | sort -_time | table _time host user source

Exam-relevant notes

• Splunk searches retrieve events from indexed data, and the selected time range limits the search scope.
• SPL is Splunk's language for searching and processing results.
• Spaces between ordinary terms imply AND.
• Quotation marks create an exact phrase search with word order and adjacency.
• OR accepts at least one alternative; NOT excludes a condition.
• Parentheses group Boolean logic.
• The pipe passes results to the next SPL command.
• A minus sign before a sort field requests descending order.
• table selects and orders displayed fields.

Next steps

After learning basic search rules, continue with Splunk fields and SPL pipes. For more advanced reporting, see the stats command, Create a Report, and Alerts Overview. You can also review Boolean Expressions for additional logic practice.