In this chapter, we introduced you to SPL. You learned that the search pipeline is crucial in the transformation of data as it is piped between search commands and eventually to the final results table. You were introduced to time modifiers to control the timespan of events that searches will consider, and the more commonly used time-range picker. You learned how to filter search results, which happens in almost every Splunk search you'll ever write. Lastly, you were introduced to multiple search commands that are commonly used.
In Chapter 4, Reporting, Alerts, and Search Optimization, we will go on to use our search processing skills to create useful reports, and learn about developing alerts that will increase organizational efficiency and prevent errors. We will also learn more on how to best optimize our searches.
