O'Reilly logo

Splunk 7 Essentials - Third Edition by Betsy Page Sigman, Erickson Delgado, J-P Contreras

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Anatomy of a search

Search processing language (SPL), a special-purpose processing language, was developed to enable fast searching on machine-generated data indexed by Splunk. The language was originally set up to be based on the Unix pipeline and Standard Query Language (SQL). SPL (as opposed to SQL) is a library of all search processing commands and their functions, arguments, and clauses. With a search command, you can group different events, filter data based on a constraint, extract fields using regular expressions, perform statistical calculations, and other tasks.

Let's dissect a search query so that you can understand exactly how it works. This will also help you to understand what pipes are. As you will see, a pipe basically takes ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required