Start searching using SPL2
You're probably asking yourself, "So how do I start searching my data?"
You start with a decision. You need ask yourself if you prefer to search using SQL-like commands or if you prefer to search using internet-like keywords.
You start a search with the pipe ( | ) character followed by a generating command.
The Search Processing Language (SPL) is based on commands separated by the pipe character ( | ). SPL is easy to write and read because you append one command after the other, rather than adding deeper and deeper nesting used by some search languages.
Start with a generating command
Your search must start with a generating command, which are commands you use to generate search results from your data. The generating commands are
The following table describes when to use each generating command:
|from command||search command||union command|
After you identify the generating command that you want to use, you must determine which dataset you want to search.
See What's a dataset.
What's a dataset?
This documentation applies to the following versions of Splunk Cloud Services: current