Splunk query vs Splunk search

[_Raj]

Hi,

I just want to understand what is the exact difference between query and search.

Thanks

[livehybrid]

HI @_Raj 

The term is typically used interchangeably to describe the "SPL" - Splunk Processing Language that is run to produce results. The SPL can be referred to as the query or search, although some users may refer to the SPL as the query and the 'search' being the action/execution of said query. 

In terms of Splunk knowledge objects, for example, a 'saved search' is a definition containing a query and other meta/params which when executed returns the results. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.