# Splunk: Exploring SPL (TryHackMe)

Link to the challenge on TryHackMe: [**Splunk: Exploring SPL**](https://tryhackme.com/room/splunkexploringspl)

```markdown
index=windowslogs
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/0455cac4-a63e-49e9-aa85-e55938fb6449.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/d47b15fa-42cb-409e-be40-a74fd750ae62.png align="center")

```markdown
index=windowslogs earliest="04/15/2022:08:05:00" latest="04/15/2022:08:06:00"
| stats count
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/8641e100-ea4c-4f14-a0e4-9451014113e2.png align="center")

```markdown
index=windowslogs EventID=4624
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/6aa93d23-f82c-46bb-a770-ba9fd45f6382.png align="center")

```markdown
index=windowslogs DestinationIp=172.18.39.6 DestinationPort=135
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/5c8161f8-b2f9-4a2d-a8ba-0d074fe9aff5.png align="center")

```markdown
index=windowslogs Hostname=Salena.Adam DestinationIp=172.18.38.5
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/b636fb63-3f55-4aa0-b0bd-6dcd1f947b08.png align="center")

```markdown
index=windowslogs cyber*
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/d186eeb7-dff4-44fd-903b-13232a126bf0.png align="center")

```markdown
index=windowslogs
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/8fb49415-2094-4e80-b645-1aa37577d136.png align="center")

```markdown
index=windowslogs | regex TargetObject="Manager$"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/776bad7c-ebf7-41cb-921a-193620ce3a7a.png align="center")

```markdown
index=windowslogs
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/b8890df4-2126-4abc-bab7-49644ef3c71b.png align="center")

```markdown
index=windowslogs | table EventID AccountName AccountType | reverse
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/517ccbb6-c231-46b6-bf93-be00b517298c.png align="center")

```markdown
index=windowslogs EventID=1
| table _time ParentProcessId ProcessId ParentCommandLine CommandLine
| reverse
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/5f7d03b5-9614-4c66-bc6e-1324ec1a98ef.png align="center")

```markdown
index=windowslogs
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/6aca7931-689f-4155-8439-e761c44fa7bb.png align="center")

```markdown
index=windowslogs | iplocation SourceIp | stats count by Region
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/e434d2cc-3077-440b-b1ae-d1ecbc11d540.png align="center")

```markdown
index=windowslogs
| lookup image_riskscore Image OUTPUT RiskScore
| stats count by Image RiskScore
| sort - RiskScore
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/b43d1802-e1e3-460e-bc3f-92feb3ad91c1.png align="center")

```markdown
index=vpnlogs
| eventstats count as logins_by_user by user 
| eventstats count as logins_by_user_country by user src_country 
| eval country_freq=logins_by_user_country/logins_by_user
| where country_freq < 0.1
| table _time user src_ip src_country country_freq
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/ebb88b04-3f6c-4b2e-877b-37fbe8dcd72a.png align="center")

```markdown
index=vpnlogs
| eval hour=tonumber(strftime(_time, "%H")) + tonumber(strftime(_time, "%M"))/60
| eventstats avg(hour) as typical_hour stdev(hour) as stdev_hour by user
| eval zscore=abs(hour - typical_hour) / stdev_hour
| where zscore > 3
| eval hour=round(hour, 2), typical_hour=round(typical_hour, 2)
| eval stdev_hour=round(stdev_hour, 2), zscore=round(zscore, 2)
| table _time user src_ip src_country hour typical_hour stdev_hour zscore
| sort - hour_zscore
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4a161d91-6c9f-4713-b4ff-6ad46d047311.png align="center")