Splunk query vs Splunk search

[_Raj]

Hi,

I just want to understand what is the exact difference between query and search.

Thanks

[PickleRick]

I suppose the confusion comes from the fact that "query" is the standard term used with SQL while the thing you do in Splunk with SPL is normally called a "search". Some people simply use the term "query" when talking about searches (especially if they have RDB background).

[livehybrid]

HI @_Raj 

The term is typically used interchangeably to describe the "SPL" - Splunk Processing Language that is run to produce results. The SPL can be referred to as the query or search, although some users may refer to the SPL as the query and the 'search' being the action/execution of said query. 

In terms of Splunk knowledge objects, for example, a 'saved search' is a definition containing a query and other meta/params which when executed returns the results. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.