While external commands can be very useful, if the number of events to be processed is large, or if performance is a concern, it should be considered a last resort. You should make every effort to accomplish the task at hand using the search language built into Splunk or other built-in features. For instance, if you want to accomplish any of the following tasks, make sure you know what to do, which is what is discussed here:
- To use regular expressions, learn to use rex, regex, and extracted fields
- To calculate a new field or modify an existing field, look into eval (search for Splunk eval functions with your favorite search engine)
- To augment your results with external data, learn to use lookups, which can also ...
