Hi Mitchell,
A good approach for this is to use the pivot interface, which you can access from settings -> data models -> pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like:
| pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
Another option is to look at the 'datamodel' search command:
| datamodel [] [<object>] []
This is documented here: http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel
HTH.
... View more