Splunk SPL is not a procedural language - you are essentially processing a pipeline of events and each command receives all the events currently in the pipeline and passes them on, processing them as it goes. The processing may add information, remove information, or combine multiple events into fewer events, or split events into more events. Try not to get hung up on procedural language constructs, take it back to what the end result should be and work with language to achieve the result. ... View more