Summary

In this chapter, we covered six categories of Splunk search commands. We learned that the streaming commands such as the implicit search command and rename are executed on the results of a search. We found out that generating commands such as makeresults, tstats, and inputlookup generate data during a search. For example, the tstats command generates data from indexed fields stored in tsidx files. Transforming commands such as table, stats, and chart change the output of a search. We looked at how we can alter the functions and syntax of some of the commands to change the way the data is displayed. We also learned that orchestrating commands such as lookup supplement fields into the search results. Dataset processing commands such as dedup, join, and sort require the complete search results before they can be executed. The join command combines search results with the results of a subsearch. We also learned how we can enhance Splunk events with lookups by creating lookup tables...