Implementing Splunk 7, Third Edition - Third Edition

About the pipe symbol

Before we dive into the actual commands, it is important to understand what the pipe symbol (|) is used for in Splunk. In a command line, the pipe symbol is used to represent the sending of data from one process to another. For example, in a Unix-style operating system, you might say:

grep foo access.log | grep bar

The first command finds, in the file access.log, lines that contain foo. Its output is taken and piped to the input of the next grep command, which finds lines that contain bar. The final output goes wherever it was destined to go, usually to the Terminal window.

The pipe symbol is different in Splunk in a few important ways:

• Unlike the command line, events are not simply text, but rather each of them is ...