About evaluating and manipulating fields

This section discusses the search commands that enable you to evaluate new fields, manipulate existing fields, enrich events by adding new fields, and parse fields with multiple values.

• At the core of evaluating new fields is the eval command and its functions. Unlike the stats command, which enables you to calculate statistics based on fields in your events, the eval command enables you to create new fields using existing fields and an arbitrary expression. The eval command has many functions. See Use the eval command and functions.
• You can easily enrich your data with more information at search time. See Use lookup to add fields from external lookup tables.
• You can use the Splunk SPL (search processing language) to extract fields in different ways using a variety of search commands.
• Your events might contain fields with more than one value. There are search commands and functions that work with multivalue fields. See Manipulate and evaluate fields with multiple values.