The Search Pipeline and Time

What is it?

An SPL search reads left to right as a pipeline: it starts by retrieving events (search terms), then each pipe (|) passes the results to a command that filters or transforms them. The time range picker bounds the whole search before it runs.

Why it matters

Reading a search as a pipeline tells you exactly what each stage does and where to change it. And the time range is the single biggest lever on speed and correctness — the wrong window hides the incident or buries you in noise.

Where you see it

In the search bar (the pipeline) and the time picker above it. Results update as a table or event list; each pipe you add changes what the next stage receives.

What normal looks like

A healthy search retrieves as few events as possible up front (specific terms + a tight time range), then transforms only those. Filtering early keeps it fast.

What suspicious looks like

Not applicable to the pipeline itself — but a search that returns nothing is often a time-range problem, not an absence of evidence. Widen the window before concluding 'nothing happened'.

How analysts investigate

Build the pipeline in stages: retrieve (narrow terms + time), then pipe to a filter or a transform, checking the result after each pipe. Set the time range to the incident window, not 'all time'.

Common beginner mistakes

Leaving the time range on 'All time' — slow, and it mixes unrelated activity into the investigation.
Transforming before filtering — running stats over millions of events instead of the few that matter.

Retrieve, then pipe to transform

  [ time range: Last 24 hours ]
  sourcetype=WinEventLog:Security result=failure   ← retrieve (narrow + time-bounded)
    |  stats count by user, src                     ← transform: how many per user+src
    |  sort -count                                  ← transform: worst first
    |  head 5                                        ← transform: keep the top 5
  each | passes its output to the next stage

A search is a pipeline: retrieve a narrow, time-bounded set, then transform it stage by stage.

Quick check

Which pipeline is both correct and efficient?

A quick self-check — it doesn't affect your XP or progress.