I get asked some form of this question often and I know what my answer is but I am curious about others. What is your opinion of the top 10 most powerful SPL command that every expert splunk user or wannabe should know well and what is on "off the beaten path that you find occasionally invaluable?
I am not an expert but these commands are my bread and butter to doing things and accomplish the objectives.
And as a command is very easy to understand but the power that has all the functions of
eval is where the magic happens.
Agree with the stats family, but not just "use stats" but "how to properly use stats" (to get rid of joins/append and other inefficient statements).
TERM (for faster matching if your data supports it)
IN (reduction of "OR"s and easier readability)
Finally, REX/REGEX. If your data is barely structured (looking at you kubernetes and rancher debug logs) , and you are good at rex/regex, then you can you interrogate the data and bend it to your will.