Splunk 7.x Quick Start Guide

Creating Splunk searches

A Splunk search is created from a series of commands and arguments using SPL. The commands and arguments are chained together using the pipe character (|) such that the output of one command is fed into the next command to the right.

Be aware that Splunk assumes the very first command on the search bar is search – you don't have to add it (unless you're creating a sub-search, in which case search is the first command to be given). I like to use Ctrl + Enter to stack my commands within the search bar—this makes it much easier to read and comprehend search strings, such as the following:

index=<index> <filter> <"text string to match"> | command1 <arguments> | command2 <arguments> | visualization commands & arguments ...