Introduction to SPL
The Search Processing Language (SPL) is a language written by Splunk that allows indexed data to be searched. SPL includes a variety of commands and functions based on the Unix pipeline and Sequential Query Language (SQL). SPL allows us to perform a variety of actions on data. We can search, filter, manipulate, and even delete information from Splunk events. We will introduce some of these actions in this chapter. But first, we will explore the Splunk search interface and understand how parts of the interface can be used to compose search queries. For example, the time picker can be used to narrow down search periods. We will also look at commands such as eval, which can be used to manipulate and modify data in an event using mathematical and string functions. Let’s get started!
In this chapter, we will explore the following topics:
- Understanding the Splunk search interface
- Dissecting a Splunk query
- Formatting and transforming data
