Configuration & query examples
Copy-paste snippets, each validated against a stated software version.
spl intermediate
Splunk SPL: Brute-Force Login Detection
A production-ready SPL search that flags brute-force login attempts — many failed authentications from a single source followed by a success — with configurable thresholds and alert-ready output.
swql intermediateSWQL: Nodes Down in the Last 24 Hours
A SWQL query that returns every node currently reporting as down, filtered to those whose status changed within the last 24 hours — with a walkthrough and alert-trigger pattern.
spl beginnerSPL: Top Blocked Source IPs from Firewall Logs
A Splunk SPL search that ranks the source IPs generating the most blocked firewall connections, with a sparkline trend over time.
swql intermediateSWQL: Find Interfaces Over 80% Utilisation
A SolarWinds SWQL query that lists every monitored interface currently running above 80% transmit or receive utilisation, with node name and percent.