Splunk Basics for SOC Beginners: Index, Sourcetype, Host and Time

Before you can write a clever Splunk search, you need to know where the data lives and how Splunk labels it. This guide explains five basics every analyst touches in the first minute of a search: index, host, source, sourcetype and time range.

What Splunk does with a log line

Splunk is a SIEM (Security Information and Event Management) platform. It collects logs from many systems, stores them, and lets you search them. The language you type into the search bar is called SPL (Search Processing Language).

When Splunk indexes data, it breaks the stream into events. An event is usually one log line or one log record, with a timestamp. Splunk also tags each event with a few default fields that describe where it came from. Those tags are what you use to narrow a search down from millions of events to the handful you care about.

Index: where the data is stored

An index is a store of events. Think of it as a labelled filing cabinet. Splunk Enterprise ships with a default index called main, and unless an administrator says otherwise, incoming data goes there. It also has internal indexes whose names start with an underscore. Two you may hear about are _internal, which holds Splunk's own logs, and _audit, which holds auditing events and user search history.

In a real organisation, administrators usually create separate indexes, for example one for firewalls, one for Windows events and one for web servers. Which indexes exist, and which ones you are allowed to search, depends on your company's setup and your role. If you search the wrong cabinet, you get nothing back, even though the data exists.

Host, source and sourcetype: three labels that look alike

These three default fields cause the most confusion for beginners. Each one answers a different question.

A simple way to remember them: host is the who, source is the where inside that machine, and sourcetype is the shape of the data.

Field	Example value	Use it to
index	web	Pick the right store of events
host	WS-114	Focus on one machine
source	/var/log/auth.log	Focus on one file or input
sourcetype	access_combined	Focus on one kind of log

Time range: the setting that hides the most results

Every event has a timestamp, which Splunk stores in the internal field _time. Splunk keeps it in UTC and shows it to you in your own time zone setting, so check your profile if times look off by an hour or more.

Next to the search bar is the time range picker, with choices such as Last 15 minutes or Last 24 hours. If the picker says Last 15 minutes and the failed logons happened two hours ago, you will see nothing. That is the most common reason for "No results found".

You can also set the time inside the search itself with earliest and latest. A time range typed in the search bar overrides the picker. Splunk's documentation also advises that when you use a relative earliest value in an ad hoc search, you add latest=now as well to avoid inaccurate time ranges.

You type	What it means
earliest=-15m	From 15 minutes ago until now
earliest=-4h latest=-2h	Between four hours ago and two hours ago
earliest=@d	Since midnight today
earliest=-24h@h latest=@h	The last 24 whole hours, ending at the start of this hour

The @ symbol means snap to. Snapping rounds down to the start of the unit, so @h means the beginning of the current hour.

Your first searches, line by line

Start with the simplest possible search and add one filter at a time.

Search 1: one host, one index, a short time window

index=main host=WS-114 earliest=-15m latest=now

This looks in the main index for events from the host WS-114 over the last 15 minutes. Each word is a field=value filter, and filters placed next to each other are combined with AND.

Search 2: add a sourcetype

index=web sourcetype=access_combined status=404 earliest=-4h latest=now

This looks in a web index for web access logs where the HTTP status is 404 (page not found), over the last four hours. The field status is not a default field. Splunk extracts it when the data is searched, which is why it only works if the sourcetype is understood.

Search 3: find out what data you actually have

index=* earliest=-15m latest=now
| stats count by index, sourcetype
| sort -count

Line 1 searches every index you are allowed to see, but only for the last 15 minutes so it stays quick. Line 2 counts events for each index and sourcetype pair. Line 3 puts the busiest at the top. This gives you a map of what is flowing in right now. Searching all indexes can be slow on a busy system, so keep the time window short and follow your team's guidance.

A four step routine for every search

1. L0
   Choose the indexName the index so Splunk does not guess or search everything.
   Where
2. L1
   Set the timeMatch the window to the alert time, with a little margin either side.
   When
3. L2
   Narrow by host or sourcetypeFocus on the machine or kind of log you care about.
   Who
4. L3
   Read the fieldsOpen an event, look at the field list on the left, and see what you can filter on next.
   What

When a search returns nothing

Back to the scenario. Before you decide the alert was wrong, work through these checks in order.

• Is the time range wide enough to include the alert time?
• Is the index correct, and are you allowed to search it?
• Is the host name spelled the way the log source writes it? Some sources send a short name, others a full domain name or an IP address.
• Try a wildcard such as host=WS-114*. Wildcards work in field values.
• Remove filters one at a time to see which one removes the data.
• If the source is genuinely silent, tell a senior analyst, because a broken log feed is itself a finding.

What to study next

This article supports the CySA+ and Security+ skill of reading and searching logs in a SIEM. I did not confirm that any named product appears in the exam objectives, so read the current CompTIA objectives document on their website to see exactly what is covered, since exam versions change.

• SPL first searches: stats, sort, where, table and rename, which is the next topic in this series.
• Time synchronisation (NTP) and why wrong clocks make timelines unreliable.
• Practice: install Splunk Enterprise free trial or use a lab instance, load a sample log file, and find its index, host, source and sourcetype in the event details.

Key takeaways

---

These five labels are the foundation of almost every Splunk search you will ever write. Open a search window today, run the third search above on a lab system, and write down which indexes and sourcetypes you find.

Written by Ben, Cybersecurity Student