transforming command

transforming command

noun

A type of search command that orders the results into a data table. Transforming commands "transform" the specified cell values for each event into numerical values for statistical purposes and are typically returned in a table format. The events themselves, and their fields, are no longer available for processing, and only the fields returned by the transforming command are available to be passed on to subsequent commands in the search. Searches that use transforming commands are called transforming searches.

Transforming commands include chart, timechart, stats, top, rare, contingency, and highlight.

Transforming commands are required to transform search result data into the data structures required for visualizations such as column, bar, line, area, and pie charts.

Note: In earlier versions of Splunk Enterprise, transforming commands were referred to as "reporting commands."

For more information

In the Search Manual:

• Types of commands
• About transforming commands and searches

In the Search Reference:

• Functions for stats, geostats, chart, and timechart

In Dashboards and Visualizations:

• Data structure requirements for visualizations