Your data will probably have been ingested into splunk and indexed and categorised into different source types with various fields extracted from the events. These are the basic classes of data you will be dealing with. However, your company may have ingested your data in any number of ways so it is difficult for anyone without that knowledge to tell you what you need to do. Do you know what sources, sourcetypes, indexes, etc. you have in splunk? Do you know which index the data you are interested in has been put in?
