3 docs tagged with "spl"

Advanced Splunk SPL — regex extraction (rex), JSON parsing (spath), windowing (eventstats vs streamstats), transaction vs stats, subsearch optimization, and production SRE observability queries.

Splunk core architecture (Search Head, Indexers, Forwarders) and SPL fundamentals — pipeline mechanics, fast filtering, bloom filters, boolean logic, and transforming commands.

Deep dive into Splunk eval command functions (case, if, coalesce, strftime/strptime) and time bucketing mechanics (bin, bucket, span, timechart, timewrap).