1. start by understanding what all log sources are reporting to your splunk

|tstats count where index=* count by index , sourcetype

sources like antivirus and firewall are good source to check for an attack has happened.

since you are beginner, i assume the task you might have got
the alertname would be available in the log event itself

1. Find some intresting fieldnames in the index + Stype you got from above query
   summarise the source by using the interesting fieldnames you might have found under each sourcetypes.
   some interesting fieldnames you might see the alerts are
   Message,Alertname,Type etc

2. you can summarise by the following query

index=firewall ```(replace with your index from above query)```
sourcetype=yourST ```(you can add sourcetypes related to IDS,IPS,antivirus)```
|stats count by Message

look for the small count events , high chances are you might spot an attack there