The head filtering command returns the first count results. Use the keepnull= option to override the default behavior, if desired. Fields, where the specified fields do not all exist, are retained by default.Use the sortby clause to change the sort order if needed. The results returned are the first results found with the combination of specified field values-generally the most recent ones.To keep all results but remove duplicate values, use the keepevents.If count is not specified, it defaults to 1 and returns the first result found. That is, this command keeps only the first count results for each combination of values of the specified fields. This command removes subsequent results that match specified criteria. Removing redundant data is the point of the dedup filtering command. Interested in learning Splunk? Enroll in our Splunk Training now! dedup Like the eval command, the where command works with a large set of expression evaluation functions. When comparing field values to literal values, simply use the search command: source=job_listings salary>80000 This example compares two fields-salary and industry_average- something we can only do with the where command. It also discards events that are missing either the salary field or the industry_average field. This example retrieves jobs listings and discards those whose salary is not greater than the industry average. For example: source=job_listings | where salary > industry_average If the evaluation is successful and the result is TRUE, the result is retained otherwise, the result is discarded. The where filtering command evaluates an expression for filtering results.

These commands take search results from a previous command and reduce them to a smaller set of results. The sort command sorts search results by the specified fields. Sorting results is the province of the sort command.

It covers the most basic Splunk command in the SPL search.

Splunk where