Tables, Charts, and Fields - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 48

2. Commands can do anything to the events they are handed. Usually,

a command does one of the following:
° Modifies or creates fields — for example, eval , rex
° Filters events—for example, head , where
° Replaces events with a report—for example, top , stats

3. Some commands can act as generators, which produce what you might

call "synthetic" events, such as |metadata and |inputcsv .

We will get to know the pipe symbol very well through examples.

Using top to show common field values
A very common question to answer is, "What values are most common?" When
looking for errors, you are probably interested in what piece of code has the most
errors. The top command provides a very simple way to answer this question.
Let's step through a few examples.

First, run a search for errors:

source="impl_splunk_gen" error

Using our sample data, we find events containing the word error , a sampling of
which is listed here:

2012-03-03T19:36:23.138-0600 ERROR Don't worry, be happy.
[logger=AuthClass, user=mary, ip=1.2.3.4]
2012-03-03T19:36:22.244-0600 ERROR error, ERROR, Error!
[logger=LogoutClass, user=mary, ip=3.2.4.5, network=green]
2012-03-03T19:36:21.158-0600 WARN error, ERROR, Error!
[logger=LogoutClass, user=bob, ip=3.2.4.5, network=red]
2012-03-03T19:36:21.103-0600 ERROR Hello world. [logger=AuthClass,
user=jacky, ip=4.3.2.1]
2012-03-03T19:36:19.832-0600 ERROR Nothing happened. This is worthless.
Don't log this. [logger=AuthClass, user=bob, ip=4.3.2.1]
2012-03-03T19:36:18.933-0600 ERROR Hello world. [logger=FooClass,
user=Bobby, ip=1.2.3.4]
2012-03-03T19:36:16.631-0600 ERROR error, ERROR, Error!
[logger=LogoutClass, user=bob, ip=1.2.3.3]
2012-03-03T19:36:13.380-0600 WARN error, ERROR, Error! [logger=FooClass,
user=jacky, ip=4.3.2.1, network=red]
2012-03-03T19:36:12.399-0600 ERROR error, ERROR, Error!
[logger=LogoutClass, user=linda, ip=3.2.4.5, network=green]