Splunk
SPL — Search Processing Language
Compose searches as a pipeline of commands to filter, transform, and aggregate events.
SPL, the Search Processing Language, is Splunk's query language and its defining skill. A search is a pipeline: you start by selecting events (an index and base filters), then pipe (|) the results through successive commands that filter, extract fields, aggregate, and format. The pipe model is intuitive — each command transforms the stream from the previous one, much like Unix pipes.
An assembly line where raw parts (events) move down a belt and each station (command) trims, labels, or counts them, so the end of the line produces a finished report.
Key Concepts
1
The most important commands cluster around statistics and transformation: stats (and tstats for indexed fields) aggregate counts, sums, and percentiles by grouping fields; eval computes new fields; rex extracts with regex; timechart buckets aggregations over time; and transaction or stats group related events. Because field extraction is schema-on-read, rex and eval let you carve structure out of raw text inside the search itself. Interview questions usually probe whether you understand the pipeline model and reach for stats/timechart rather than brute-force scanning.