Up to this point, we have learned how to search for and retrieve raw events, but you will most likely want to create tables and charts to expose useful patterns. Thankfully, the reporting commands in Splunk make short work of most reporting tasks. We will step through a few common-use cases in this chapter. Later in the chapter, we will learn how to create custom fields for even more custom reports.
Specifically, in this chapter we will cover the following topics:
The pipe symbol
Using top to show common field values
Using stats to aggregate values
Using chart to turn data
Using timechart to show values over time
Working with fields
Acceleration