Splunk Search
Highlighted

What are the functions of commas and periods in the Splunk search language?

Communicator

I was just wondering if the commas in this search are just to aid readability of the code, or if they are important to the functioning of the search.

AllChanges.src,AllChanges.AccountManagement.srcntdomain,AllChanges.user

Also, what is the function of the period in between "AllChanges" and "AccountManagement.srcntdomain".

Thank you for your help!

Highlighted

Re: What are the functions of commas and periods in the Splunk search language?

Legend

The commas are for readability (you can substitute w/space) and the periods could be to represent data hierarchy. So, AllChanges.src could mean the src node under AllChanges. This is applicable when your orginal data is represented either in JSON or XML format

View solution in original post

Highlighted

Re: What are the functions of commas and periods in the Splunk search language?

Communicator

Great thank you for your answer!

So AllChanges.src,AllChanges.AccountManagement.srcntdomain,AllChanges.user
is the same as: AllChanges.src AllChanges.AccountManagement.srcntdomain AllChanges.user

So does that mean that there is an implied "AND" where the commas are? I recall learning that there is an implied AND between terms with spaces. Or is that only true regarding functions or commands?

Also, I found a definition on the Splunk website that stated that the definition for: All_Changes.src was: The resource where the change was originated. I'm not really sure what change that is talking about. My original search query was:

| tstats `summariesonly` count from datamodel=Change_Analysis where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user | sort 100 - count | `drop_dm_object_name("All_Changes")` |  `drop_dm_object_name("Account_Management")`

I think that the line I originally posted summarizes the statistics I'm getting with the tstats function but I'm not sure how it's summarizing the data as I don't have access to Splunk right now.

Thank you for all your help!

Highlighted

Re: What are the functions of commas and periods in the Splunk search language?

Communicator

One last thing,

What does the -- All_Changes.result="lockout" -- do?

Thank you so much for your help!

0 Karma
Highlighted

Re: What are the functions of commas and periods in the Splunk search language?

Legend

All_Changes.result="lockout" filters all events in the datamodel where the value for result attribute in the datamodel called 'All_Changes" is "lockout"

Highlighted

Re: What are the functions of commas and periods in the Splunk search language?

Communicator

Ok great thank you very much.

0 Karma