topic Re: pipeline as first character in search query in Splunk Search

pipeline as first character in search query

kkkelvinkk — Wed, 12 Apr 2017 16:39:32 GMT

Hi all,

I would like to ask what is the meaning of using pipeline as first character in search query. I saw some video tutorial that will use pipeline as first character and also correlation search in enterprise security.
Thanks all.

Re: pipeline as first character in search query

DalJeanis — Wed, 12 Apr 2017 16:51:15 GMT

It depends on the kind of verb you use.

If there is no pipeline character first, then the implied verb is "search". Every other verb which is a "generating command" requires the pipeline character before the verb.

http://docs.splunk.com/Splexicon:Generatingcommand

Re: pipeline as first character in search query

masonmorales — Wed, 12 Apr 2017 18:36:10 GMT

This answer has a good explanation. I would add that a pipe must precede all search commands.

Re: pipeline as first character in search query

DalJeanis — Wed, 12 Apr 2017 18:42:33 GMT

Mason - The phrase "all search commands" is ambiguous and might mislead some readers... especially since the implicit search at the start of any search query is the main exception...

Re: pipeline as first character in search query

masonmorales — Wed, 12 Apr 2017 19:24:33 GMT

Splunk Docs and the Quick Reference Guide all say, "search commands", so I believe I am using proper nomenclature here.

Re: pipeline as first character in search query

kkkelvinkk — Tue, 29 Sep 2020 13:39:06 GMT

Below is the search query I extracted from Enterprise Security:

| tstats allow_old_summaries=true count as change_count from datamodel=Change_Analysis.All_Changes by All_Changes.user,All_Changes.change_type | drop_dm_object_name("All_Changes") | xswhere change_count from change_count_by_user_by_change_type_1d in change_analysis by change_type is above high

From my understanding, some data is search and then pipeline to "generating command". So, what is being passed as argument from the above search query ? I mean the pipeline being putting as the first character. Or it is just the correct syntax to use splunk ?