Data Analytics Using Splunk 9.x

4

Introduction to SPL

The Search Processing Language (SPL) is a language written by Splunk that allows indexed data to be searched. SPL includes a variety of commands and functions based on the Unix pipeline and Sequential Query Language (SQL). SPL allows us to perform a variety of actions on data. We can search, filter, manipulate, and even delete information from Splunk events. We will introduce some of these actions in this chapter. But first, we will explore the Splunk search interface and understand how parts of the interface can be used to compose search queries. For example, the time picker can be used to narrow down search periods. We will also look at commands such as eval, which can be used to manipulate and modify data in an event ...