Guides

Splunk App Quick Reference Guide

A Summary of queryai Commands to Use From Splunk

Suggest Edits

📘

TL;DR Splunk App Quick Reference

Context: This is a convenient, condensed reference guide for using the Query Splunk App. We hope that you are already familiar with the Query Splunk App! If not, you can start from the beginning at https://docs.query.ai/docs/about-query-splunk-app.

Nutshell: This page explains how you can pipe your Splunk searches to the queryai command to direct your searches to all Query-connected data sources (Platform Connectors), expanding the reach of your Splunk environment through Query, without bulk data ingestion or Splunk license increases.

Contents: Below you will find queryai command syntax, operators, searchable Entities/Events/Objects, and our most popular usage tips. At the end is a link to the full Query Splunk App Search documentation page.


Command Syntax

Syntax: 

| queryai search=”<search conditions>” platforms="<list of platforms>" timeout=<seconds>

Example:

| queryai search="ip = 172.16.16.10" platforms="S3, elastic, sentinel" timeout=60

Syntax notes:

  • platforms and timeout parameters are optional.
  • Platforms are unique to your Query installation, and are defined in the Query "Connections" page.

Searchable Entities, Objects, and Events

Searchable EntitiesSearchable ObjectsSearchable Events
email
file_hash
file_name
hostname
ip
mac_address
process_name
resource_id
url
user_agent
username





















actor
agent
data_security
device
domain_info (deprecated)
domain_intelligence
file
file_intelligence
ip_intelligence
threat_intelligence
url
url_intelligence
user



















Application Activity
api_activity
application_lifecycle
datastore_activity
file_hosting
web_resources_activity
config_state
patch_state
user_inventory

Findings
compliance_finding
data_security_finding
detection_finding
incident_finding
security_finding (deprecated)
vulnerability_finding

Identity & Access Mgmt
account_change
authentication
authorize_session

Network Activity
dns_activity
email_activity
email_delivery_activity
http_activity
network_activity

System Activity
file_activity
module_activity
process_activity

Full Schema: https://schema.query.ai/
Events Schema: https://schema.query.ai/events.html
Objects Schema: https://schema.query.ai/objects.html


Conditional Operators

Conditional Operators
Equals: =
Not Equals: !=
NOT (Boolean): NOT
Logical AND: AND
Logical OR: OR
IN: IN (value1, value2, value3,...)
Contains: *value*
Starts With: value*
Ends With: *value
All: *

Example Searches

Search ConditionExamples
With platforms and timeout parameters

(Platform aliases are configuration-specific.)		| queryai search="ip = 172.16.16.10" platforms="S3, elastic, sentinel" timeout=60
Equals| queryai search="ip = 8.8.8.8"

| queryai search="file_hash = b5045d802394f4560280a7404af69263"
Not Equals| queryai search="user.devices.domain != xyzdomain"

| queryai search="email != *@xyz.com"
Starts With

(Only for strings.)
(No quoted values.)
(Not supported for URL field by threat intelligence platforms like VirusTotal.)		| queryai search="hostname = mac*"

| queryai search="user.name = sam*"
Ends With

(Only for strings.)
(No quoted values.)
(Not supported for URL field by threat intelligence platforms like VirusTotal.)		| queryai search="hostname = *mac"

| queryai search="user.name = *anand"
Contains

(Only for strings.)
(No quoted values.)
(Not supported for URL field by threat intelligence platforms like VirusTotal.)		| queryai search="hostname = mac"

| queryai search="user.name = ana"
Boolean NOT| queryai search="NOT (user.name=ana OR user.email_addr=[email protected] )"

| queryai search="NOT user.name IN (ana, ava, 'abc xyz', 'abc pqr')"
Logical AND

(When AND-ing multiple conditions, you must use the same Object and Event types - like "user" - between the conditions.)		| queryai search="user.name=al AND user.email_addr=[email protected]"

(AND can also be used implicitly, as below.)

| queryai search="user.name=al user.email_addr=[email protected] "
Logical OR

(It is valid to do OR-ing across multiple event/object types.)		| queryai search="user.name=ana OR user.email_addr=[email protected]"

| queryai search="user.name = abc OR device.ip=1.1.1.1"
IN| queryai search="user.name IN (ana, ava, 'abc xyz', 'abc pqr')"

| queryai search="network_activity.src_endpoint.ip IN (1.1.1.1, 1.2.3.4)"
ALL| queryai search="authentication.logon_type_id = *"

| queryai search="authentication = *"

(You can use this type of search to identify records with NULL values, too, as below.)
| queryai search="NOT user.email_addr = *"
SPL spath

(When you have a value containing further fields, you can use the SPL spath command to extract them.)		| queryai search="ip = 172.16.16.10" platforms=”Crowdstrike” | spath input=_raw

(The _raw field contains native platform data mapped from OCSF's raw_data. You can extract further fields from native data by adding the spath pipe operation as
... | spath input=_raw
(or simply
... | spath
since splunk uses _raw as the default for the input parameter.)

Usage Notes

  • Entities, Events, Objects, and their attribute names are case-sensitive.
  • Entity searches allow for a maximum of one condition. Therefore, you may not use AND / OR / IN / * wildcard operations if your condition is on an Entity. (But you can likely use an Object or Event search instead.)
  • Values containing reserved keywords (like AND, OR, NOT, IN), whitespaces, or special characters (like dots, @, etc.) should be enclosed inside single or double quotes.
  • Values are generally case-insensitive. (With few exceptions, e.g., enum attribute values are uppercase. So rather than an enum value of ‘Informational,’ use ‘INFORMATIONAL.’)
  • For enum values, although the QDM documentation shows both values and an internal numeric code, use only the uppercase style values. (Rather than a scan_activity.severity_id value of "1," use "INFORMATIONAL.")
  • Hierarchical attributes can be accessed at a maximum depth of two dots, e.g., network_activity.src_endpoint.ip.
  • Nesting of parentheses is not supported. However, you can use multiple parentheses to associate separate condition sections.

Updated about 1 month ago

What’s Next

Want more complete guidance? Hop over to the full description of how to search with the Query Splunk App.