Start searching using SPL2

You're probably asking yourself, "So how do I start searching my data?"

You start with a decision. You need to ask yourself if you prefer to search using SQL-like commands or if you prefer to search using internet-like keywords.

You start a search with the pipe ( | ) character followed by a generating command.

The Search Processing Language (SPL) is based on commands separated by the pipe character ( | ). SPL is easy to write and read because you append one command after the other, rather than adding deeper and deeper nesting used by some search languages.

Start with a generating command

Your search must start with a generating command, which are commands you use to generate search results from your data. The generating commands are from, search, and union.

The following table describes when to use each generating command:

from command	search command	union command
Not familiar with SQL or SPL? Start with the from command. Already familiar with SQL? Use the from command. It's similar to the SQL SELECT. The from command is the most commonly used SPL2 generating command.	Familiar with SPL? Start with the search command. Use the search command when you need to search more than one index.	Use the union command to combine two datasets together.
With the from command, you use SQL-like clauses such as SELECT, WHERE, GROUP BY, and ORDER BY.	With the search command, you use keywords and field-value pairs. You can use the TERM() directive to match a single term, even if the term contains characters such as periods or underscores.

After you identify the generating command that you want to use, you must determine which dataset you want to search.

Next step

See What's a dataset.