Splunk SPL — detection engineering

Author and review SPL for Splunk Enterprise / Enterprise Security. The discipline here mirrors the rigour applied to KQL in kusto-query-language — filter early, structure deliberately, and document every assumption.

Distilled from: Analysis of 2009 production detections, 234 macros, and 104 lookups in splunk/security_content (ESCU v5.26+).

1. Search-time discipline

1.1 Always lead with metadata fields index, sourcetype, time

Splunk searches without an index constraint scan the indexes defined as default. In production environments, there is no default index — i.e. no index constraint, no search. Always start a search with the most selective root expression Splunk offers:

index=wineventlog sourcetype="WinEventLog:Security" earliest=-7d@d latest=now