From the course: Splunk Core Certified User (SPLK-1001) Cert Prep

Unlock this course with a free trial

Join today to access over 25,400 courses taught by industry experts.

Overview of transforming commands

Overview of transforming commands - Splunk Tutorial

From the course: Splunk Core Certified User (SPLK-1001) Cert Prep

Start my 1-month free trial Buy for my team

Overview of transforming commands

“

So, as we just said, transforming commands are used to order search results into a statistics table. So in the example here, we are using the stats command to count the number of events by client IP. So in our data set, we have multiple client IPs. We want to see how many events exist for each client IP in the result set. So the stats table shows the client IP values and the corresponding count of events. So if you go there, you're going to see that for each client IP that you have here, you're going to have the count of events on the right client IP count of events. So what you notice with the transforming commands here is that as soon as you run transforming commands on your data, then it's going to show the results on the statistics tab. So if you just go ahead and run index equals web, source type equals access combined, you're going to see your events here. But as soon as you execute the transforming commands, because we say that it orders the search results into a statistics…

Contents