Introduction

In the previous chapter, we learned about the various ways to get data into Splunk. In this chapter, we will pe right into the data and get our hands dirty.

The ability to search machine data is one of Splunk's core functions, and it should come as no surprise that many other features and functions of Splunk are heavily driven by searches. Everything from basic reports and dashboards through to data models and fully featured Splunk applications is powered by Splunk searches behind the scenes.