Search processing language (SPL), a special-purpose processing language, was developed to enable fast searching on machine-generated data indexed by Splunk. The language was originally set up to be based on the Unix pipeline and Standard Query Language (SQL). SPL (as opposed to SQL) is a library of all search processing commands and their functions, arguments, and clauses. With a search command, you can group different events, filter data based on a constraint, extract fields using regular expressions, perform statistical calculations, and other tasks.
Let's dissect a search query so that you can understand exactly how it works. This will also help you to understand what pipes are. As you will see, a pipe basically takes the data that has come from an earlier step, and after it has been acted on, filtered, or extracted, it sends it on to the next step...
