Mastering Splunk

Search results

When you run a Splunk search, you'll see that not all of the Splunk Web search results tabs (Events, Statistics, and Visualization) will be populated.

• Event searches: If your search returns only events, only the Events results tab is populated
• Transformational searches: If your search includes transforming commands, you can view the results in the Statistics and Visualization tabs (as well as in the Events tab)
• Transformational commands: Transformational commands transform the event results into numerical values that Splunk can use for statistical purposes, that is, creating charts, tables, and graphs

Transforming commands include the following:

• chart
• timechart
• stats
• top
• rare
• contingency

Some basic Splunk search examples

To illustrate the differences ...