Introduction

Use the Splunk Search Processing Language (SPL) and SPL2 to curate and search your data.

The Search Processing Language (SPL) is a set of commands that you use to curate and search your data.

There are two versions of SPL: SPL and SPL, version 2 (SPL2). This SPL2 Search Reference manual describes SPL2.

Note:

If you are looking for information about using SPL, see the following:

For Splunk Cloud Platform, see the Search Reference in the Splunk Cloud Platform documentation.
For Splunk Enterprise, see the Search Reference in the Splunk Enterprise documentation.

About the SPL2 Search Reference

The SPL2 Search Reference provides comprehensive reference information about the commands and functions that are supported in SPL2.

The SPL2 Search Reference provides comprehensive reference information about the commands and functions that are supported in SPL2, including detailed syntax descriptions and examples. Consult this manual to discover the built-in commands and functions that you can use to work with data in searches and data pipelines.

You'll learn:

  • About the search commands supported with SPL2, including the syntax and usage for each command.

  • About the built-in statistical and evaluation functions supported with SPL2.

  • Which SPL2 commands and functions are compatible with the Splunk apps and products that support using SPL2.

  • By having access to an extensive set of examples for using each command and function.

To get started, see the following pages:

For this informationRefer to this page

Explanations of how to interpret the syntax that's documented in this manual.

Understanding SPL2 syntax

A list of the supported commands and where they are documented.

Quick Reference for SPL2 commands

A list of the supported eval functions and where they are documented.

Quick Reference for SPL2 eval functions

A list of the supported stats and charting functions and where they are documented.

Quick Reference for SPL2 stats and charting functions

Learn more about SPL2

There are 2 other Splunk manuals that contain information about SPL2.

SPL2 Overview

The SPL2 Overview describes:

  • What is SPL2 and why you will want to use it.

  • Which Splunk applications and products support using SPL2.

  • What the differences are between SPL and SPL2.

  • The resources that are available for you to learn SPL2.

For an introduction to SPL2, see the following pages in the SPL2 Overview:

SPL2 Search Manual

The SPL2 Search Manual contains information about how to use SPL2 effectively. You'll learn:

  • How to get started searching.

  • The differences between using SPL2 in the Search bar and in the SPL2 module editor to create your searches.

  • How to use expressions and predicates.

  • How to create custom functions and data types.

For guidance on how to write valid SPL2 searches and expressions, see the following pages in the SPL2 Search Manual: