# 🔎 Writing SPL

Search Processing Language (SPL) is the standard for querying big data in Splunk.

## 📝 The Scenario
Your boss says "Find all failed logins from China in the last 24 hours."

## 📝 The Raw Query (SPL)

```splunk
index=main sourcetype=wineventlog:security EventCode=4625 
| iplocation SourceNetworkAddress 
| search Country="China"
| stats count by SourceNetworkAddress, User
| sort - count
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Filter Phase
* `index=main`: Search only the main storage.
* `EventCode=4625`: Windows Failed Identity.

### Step 2: Enrichment
* `iplocation`: Splunk automatically adds `Country`, `City`, `Lat`, `Lon` based on the IP address.

### Step 3: Aggregation
* `stats count by...`: Instead of showing 10,000 individual log lines, show me a table.
* **Row 1**: IP `1.2.3.4`, User `Admin`, Count `500`.
* **Conclusion**: We are under a brute force attack.
