SPLK-RMOD - Result Modification

Topic 1 – Manipulating Output

• Convert a 2-D table into a flat table with the untable command
• Convert a flat table into a 2-D table with thexyseries command

Topic 2 – Modifying Result Sets

• Append data to search results with the appendpipe command
• Calculate event statistics with the eventstats command
• Calculate "streaming" statistics with the streamstats command
• Modify values to segregate events with the bin command

Topic 3 – Managing Missing Data

• Find missing and null values with the fillnull command

Topic 4 – Modifying Field Values

• Understand the eval command
• Use conversion and text eval functions to modify field values
• Reformat fields with the foreach command

Topic 5 – Normalizing with eval

• Normalize data with eval functions
• Identify eval functions to use for data and field normalization