Database Reference
In-Depth Information
What is Search Processing Language
(SPL)?
After we have our data indexed, we can begin to search. The default application for Splunk
is the search application. It is assumed that you are doing a search unless you indicate oth-
erwise. Searches are made using the
Search Processing Language
(
SPL
). Through search,
Splunk lets the user comb through the indexed data to find what he or she needs for an-
swering questions.
In the simplest of terms, if you only put the term failed in the search box, for instance, it
knows you want to do a search and will automatically search for
failed
anywhere in the
data, and will return each event that fits with failed highlighted.
