Question is what kind of data you have in your Splunk.
Remember that Splunk is a data analytics solution, not an EDR, A/V, web-gateway or anything else.
So in order to find some information in it you first have to ingest the data. In other words - if you're not monitoring the system you want to query Splunk about, you won't get any information because Splunk doesn't know anything about.
