Chapter 3. Tables, Charts, and Fields

Up to this point, we have learned how to search for and retrieve raw events, but you will most likely want to create tables and charts to expose useful patterns. Thankfully, the reporting commands in Splunk make short work of most reporting tasks. We will step through a few common-use cases in this chapter. Later in the chapter, we will learn how to create custom fields for even more custom reports.

Specifically, in this chapter we will cover the following topics:

• The pipe symbol
• Using top to show common field values
• Using stats to aggregate values
• Using chart to turn data
• Using timechart to show values over time
• Working with fields
• Acceleration