Splunk
SPL — Search Processing Language
Compose searches as a pipeline of commands to filter, transform, and aggregate events.
SPL, the Search Processing Language, is Splunk's query language and its defining skill. A search is a pipeline: you start by selecting events (an index and base filters), then pipe (|) the results through successive commands that filter, extract fields, aggregate, and format. The pipe model is intuitive — each command transforms the stream from the previous one, much like Unix pipes.
An assembly line where raw parts (events) move down a belt and each station (command) trims, labels, or counts them, so the end of the line produces a finished report.
Key Concepts
1
The most important commands cluster around statistics and transformation: stats (and tstats for indexed fields) aggregate counts, sums, and percentiles by grouping fields; eval computes new fields; rex extracts with regex; timechart buckets aggregations over time; and transaction or stats group related events. Because field extraction is schema-on-read, rex and eval let you carve structure out of raw text inside the search itself. Interview questions usually probe whether you understand the pipeline model and reach for stats/timechart rather than brute-force scanning.
2
What the interviewer is probing.
What the interviewer is probing.
3
1. "What is the structure of an SPL search?" *Probing:* the model. *Stalls:* "A query." *Moves
up:* a base search retrieving events, piped through commands that transform, filter and aggregate.
1. "What is the structure of an SPL search?"
4
2. "Why does the base search matter so much?" *Probing:* the performance point. *Stalls:* "It
does not." *Moves up:* everything it returns is processed downstream, so narrowing by index,
sourcetype and time is the single biggest speed factor.
2. "Why does the base search matter so much?"
5
3. "What is the difference between stats and eventstats?" *Probing:* the detail. *Stalls:*
"Nothing." *Moves up:* stats aggregates and discards the original events; eventstats adds the
aggregate back onto each event.
3. "What is the difference between stats and eventstats?"
6
4. "What are accelerated data models for?" *Probing:* the optimisation. *Stalls:* "Nothing."
*Moves up:* precomputed summaries so tstats queries return in seconds over data that would take
minutes to scan raw.
4. "What are accelerated data models for?"