skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

splunk

Create Splunk SPL detection engineering searches with CIM data models and tstats.

4|1|Updated Apr 28, 2026
Search Tags:#detection-engineering#correlation#splunk#datamodel#cim#splunk-spl#tstats
One-click install
npx skills add https://github.com/OpenTideHQ/AgentTide --skill splunk-opentidehq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: splunk
Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/splunk
Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill splunk-opentidehq

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Splunk SPL discipline guides detection engineers to craft robust, efficient searches that scale across wide datasets and multiple sourcetypes, reducing false positives and speeding investigations.

Core Features & Use Cases

  • Search-time discipline: Always start with index and sourcetype, bound time with earliest/latest, and push filtering into the base search to minimize data scanned.
  • Accelerated querying with CIM: Prefer tstats on accelerated CIM data models for high-volume, low-latency detections.
  • Three-layer macro architecture: Layer 1: Source macros, Layer 2: Process macros, Layer 3: Filter macros to enable portable, reusable detections.
  • Anomaly, Hunting, and RBA patterns: Supports anomaly detection via eventstats, hunting-style broad filters, and risk-based alerting workflows.
  • ES correlation lifecycle: Notable events, suppression/throttling, and lifecycle best practices for enterprise correlation searches.

Quick Start

Begin with a baseline indexed search for a Windows Security event and iteratively layer tstats, CIM patterns, and correlation constructs.

Frequently Asked Questions about splunk

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write efficient Splunk SPL for detection engineering?▼

Efficient Splunk SPL for detection engineering requires starting with index and sourcetype, bounding time with earliest/latest, and pushing base search filtering early to minimize data scanned and reduce false positives.

When should I use tstats instead of stats in Splunk searches?▼

Use tstats instead of stats in Splunk searches when querying high-volume data for low-latency detections, leveraging accelerated CIM data models to scale efficiently across wide datasets.

What is the three-layer macro architecture in Splunk SPL?▼

The three-layer macro architecture in Splunk SPL consists of Layer 1 source macros, Layer 2 process macros, and Layer 3 filter macros, enabling portable and reusable detection engineering searches.

How do I configure Splunk Enterprise Security correlation searches and notable events?▼

Configure Splunk ES correlation searches by defining notable events, applying suppression and throttling, and following risk-based alerting workflows alongside enterprise correlation lifecycle best practices.

Does this Splunk SPL guidance apply to Splunk Enterprise Security analytics?▼

Yes, this Splunk SPL guidance applies directly to Splunk Enterprise and Enterprise Security analytics, covering CIM data models, index discipline, and correlation workflows for enterprise data.

Related Skills

Explore More Data & Analytics Skills→
incidentfoxincidentfox
654

splunk-analysis

Investigate Splunk logs to identify root causes using SPL queries.

Official
Intermediate
chambear2809chambear2809
36

splunk-enterprise-security-config

Configure and validate Splunk Enterprise Security deployments with declarative YAML workflows.

Community
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced