In Splunk, searches can be initiated in both Splunk Web as well as in the Splunk command-line interface or CLI (for information on how to access the CLI and find help for it, refer to the SplunkAdmin manual).
Your searches in CLI work the same way as searches in Splunk Web, except that there is no timeline given with the search results and there is no default time range. Instead, the results are displayed as a raw events list or a table, depending on the type of your search. Searching parameters (such as batch, header, and wrap) are options that control the way the CLI search is run or the way the search results are displayed.
Note
In addition to Splunk Web and Splunk CLI, there is an applications programming interface (API) available, which Splunk programmers can use to perform searches and manage Splunk configurations and objects.
Searching with the CLI will not be covered in this book, so our discussion on searching with parameters will focus on the (advanced) searching...