Learn SPL Command Types: Efficient Search Execution Order and How to Investigate Them
When performing searches, Splunk uses its own language, SPL (Search Processing Language). SPL commands can be categorized into several types depending on the processing they perform. Especially in a distributed environment where the Splunk system is made up of multiple servers, if you do not understand which components perform heavy processing depending on the SPL type, you may create inefficient searches.