What are the functions of commas and periods in the Splunk search language?

[Justin1224]

I was just wondering if the commas in this search are just to aid readability of the code, or if they are important to the functioning of the search.

All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user

Also, what is the function of the period in between "All_Changes" and "Account_Management.src_nt_domain".

Thank you for your help!

[sundareshr · Accepted solution]

The commas are for readability (you can substitute w/space) and the periods could be to represent data hierarchy. So, All_Changes.src could mean the src node under All_Changes. This is applicable when your orginal data is represented either in JSON or XML format

[Justin1224]

Great thank you for your answer!

So All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user
is the same as: All_Changes.src All_Changes.Account_Management.src_nt_domain All_Changes.user

So does that mean that there is an implied "AND" where the commas are? I recall learning that there is an implied AND between terms with spaces. Or is that only true regarding functions or commands?

Also, I found a definition on the Splunk website that stated that the definition for: All_Changes.src was: The resource where the change was originated. I'm not really sure what change that is talking about. My original search query was:

| tstats `summariesonly` count from datamodel=Change_Analysis where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user | sort 100 - count | `drop_dm_object_name("All_Changes")` |  `drop_dm_object_name("Account_Management")`

I think that the line I originally posted summarizes the statistics I'm getting with the tstats function but I'm not sure how it's summarizing the data as I don't have access to Splunk right now.

Thank you for all your help!

[Justin1224]

One last thing,

What does the -- All_Changes.result="lockout" -- do?

Thank you so much for your help!

[sundareshr]

All_Changes.result="lockout" filters all events in the datamodel where the value for result attribute in the datamodel called 'All_Changes" is "lockout"

[Justin1224]

Ok great thank you very much.