Querymason

Querymason is the SPL query builder for Splunk professionals who need to work fast. Whether you're in the middle of an incident response, running threat hunts, or just tired of rewriting the same queries from scratch — Querymason puts every search pattern one tap away. BUILD QUERIES INSTANTLY Choose a data source, select a query type, fill in your parameters, and get a complete, production-ready SPL query — syntax-highlighted and ready to paste into Splunk. 20+ DATA SOURCE PROFILES • Network: Router and switch syslog, network access control, next-generation firewalls, SolarWinds, Generic Firewall • Server: Linux Syslog, Windows WEC, Windows Sysmon, CrowdStrike • Data Center: VMware ESXi, VMware vCenter, NetApp, Pure Storage • Applications: Apache HTTP, Microsoft IIS, Nginx, Okta, Microsoft 365 QUERY LIBRARY 40 pre-built, production-tested SPL templates covering the most common SOC and IT operations use cases. Browse, filter, and copy in one tap. The free SOC Starter pack adds 12 more, ready to install from Packs. SHARE WITH YOUR TEAM Export your custom templates to share with teammates and import theirs. Templates you already have are skipped. QUERY HISTORY & PRESETS Never rewrite the same query twice. Querymason keeps your last 75 searches and lets you save unlimited named presets for one-tap recall. SPL ADVISOR A built-in advisor reviews your query and suggests performance improvements and command explanations. It works offline, and nothing leaves your device. PRO — ONE-TIME PURCHASE Everything above is free. One optional in-app purchase unlocks Pro: • Learning mode: an Explain switch on the query result walks through each pipe of your query in plain language, with short practice questions to test yourself • Sector packs built into the app: Threat Hunting (25 queries), Cloud Audit (18) and IT Ops Health (15) • Future Pro features at no extra cost Pay once. No subscription, no account. Restore Purchase is in the Pro screen. DESIGNED FOR THE FIELD A distraction-free dark interface built for long shifts. Syntax highlighting, copy-to-clipboard, and a clean 4-step wizard mean fewer mistakes under pressure. PRIVACY FIRST Querymason works entirely on-device. No telemetry, no accounts, no network calls. Purchases are handled entirely by Apple. Your queries never leave your device. Querymason is an independent product. It is not affiliated with, endorsed by or sponsored by Splunk Inc. Splunk® is a registered trademark of Splunk Inc.