Reporting Commands, Lookups, and Macros
We introduced SPL in Chapter 4, Introduction to SPL, by looking at the structure of basic Splunk searches. We also looked at a few commands, such as eval and fields. These commands are called streaming commands and are performed on each event returned from a search. However, the power of Splunk comes from the variety of available commands. In this chapter, we will look at other types of commands, including other streaming, generating, transforming, orchestrating, and dataset processing commands. This chapter is not a replacement for the Splunk documentation. We will not explore all the commands in detail; instead, we will introduce a selection of commonly used commands in the form of examples. However, by the end of this chapter, we will have covered sufficient Splunk commands to fully appreciate Splunk.
In this chapter, we will cover the following topics:
- Exploring more Splunk commands
- Enhancing logs with lookups
- Simplifying...
