Before we dive into the actual commands, it is important to understand what the pipe symbol (|) is used for in Splunk. In a command line, the pipe symbol is used to represent the sending of data from one process to another. For example, in a Unix-style operating system, you might say:
grep foo access.log | grep bar
The first command finds, in the file access.log, lines that contain foo. Its output is taken and piped to the input of the next grep command, which finds lines that contain bar. The final output goes wherever it was destined to go, usually to the Terminal window.
The pipe symbol is different in Splunk in a few important ways:
- Unlike the command line, events are not simply text, but rather each of them is a set of key/value pairs. You can think of each event as a database row, Python dictionary, JavaScript object, Java map, or Perl associative array...
