Exploring more Splunk commands

There are six types of commands in Splunk: distributable streaming, centralized streaming, generating, transforming, orchestrating, and dataset processing commands. In some cases, the way a command functions depends on where it is in the search. We will explore the different types of commands in the following subsections.

Streaming commands

We covered eval, fields, regex, and rex in Chapter 4, Introduction to SPL. These commands are streaming commands – that is, they are executed on the results of a search. There are two types of streaming commands:

• Distributed streaming: Runs on the indexer or the search head. We will look at the rename command in this section.
• Centralized streaming: Runs only on the search head. We will look at the head command in this section.

The rename command is an example of a distributed streaming command. It is used to rename fields. It is very useful for situations where the field names are long...