Splunk built the log-search category. At its core it indexes any text data - application logs, syslog, Windows events, firewall records, CSV exports - and lets you search across all of it with the Search Processing Language (SPL), a piped query syntax that filters, transforms, and aggregates events in a single chain. Its dominance is strongest in security: Splunk Enterprise Security is one of the most widely deployed SIEMs, and many organizations run Splunk first for compliance and threat detection, with operational monitoring as a secondary use.

Index-time vs. search-time

Data flows in through forwarders, gets parsed into events, and is written to an index with a timestamp and a handful of default fields. Splunk's design choice is to do most field extraction at search time rather than index time - raw events are stored, and SPL extracts fields when you query. This makes ingestion schema-flexible (you can search fields you never declared up front) at the cost of doing the parsing work on every query, which is why well-written searches that filter early matter for performance.

SPL searches

An SPL search reads left to right, each | piping the result set into the next command:

index=web sourcetype=access_combined status>=500
| stats count AS errors, avg(response_time) AS avg_ms by host
| where errors > 100
| sort -errors

The same pattern handles security investigations - searching authentication logs for failed-then-succeeded login sequences, joining across sourcetypes, and feeding the result into a correlation search that raises a notable event.

Frequently asked questions

What is SPL? The Search Processing Language - Splunk's piped query syntax where each command transforms the event stream, used for everything from a quick stats count by host to multi-stage security correlations.

Why is Splunk associated with security? Splunk Enterprise Security is a leading SIEM; its index-everything, search-anything model fits threat hunting and compliance, where you must retain and query large volumes of disparate event data.

How is it priced, and why does that matter? Traditionally by daily indexed volume (with workload-based options added later). High ingest is the cost driver, which pushes teams to filter or route low-value logs elsewhere before they hit a Splunk index.

Why search-time field extraction? Storing raw events and extracting fields at query time keeps ingestion schema-flexible, at the price of repeating parse work per search - so filtering early in a search is the main performance lever.

See the monitoring & logging overview and compare with Graylog.