VMware ESXi and vSphere Cluster Management

Using Pipes to Chain Search Commands in Splunk

Learn how Splunk pipes pass results between search commands, control pipeline order with head and sort, and build searches using eval, stats, and chart.

What a Pipe Means in Splunk

In Splunk Search Processing Language (SPL), a pipe is the vertical bar character |. It connects one search stage to the next.

The results produced on the left side of a pipe become the input for the command on the right. A search can contain one pipe or several consecutive pipes, creating a multi-stage search pipeline.

base search | command | command

For example:

index=main | head 50 | sort host

Splunk first runs the base search, then passes its results to head, and finally passes the reduced result set to sort.

The Search Pipeline Execution Model

A base search is the initial expression that retrieves matching events. It commonly specifies an index, keywords, or field conditions. Commands after the base search process the result set created by the preceding stage.

1. The base search retrieves matching events within the selected time range.
2. The first piped command receives those events and filters, transforms, or summarizes them.
3. The next command receives the output from the previous command.
4. The final stage produces the results displayed in Splunk.

Command order matters because each stage changes what the next stage can see. For example, head 50 followed by sort host sorts only the 50 retained events. Reversing the commands sorts the full result set first and then keeps the first 50 sorted results.

Basic Pipe Syntax

Place a pipe after the base search, followed by a search command. Spaces around the pipe make the stages easier to read and are the usual style.

base_search | command

Add another pipe whenever another processing stage is needed:

base_search | command_one | command_two | command_three

Read a piped search from left to right. Each pipe marks the boundary between the result set created by one stage and the command that consumes it.

Pipeline Stages and Their Inputs and Outputs

Common Uses of Piped Commands

Fields are named values associated with events. They may come from event metadata, such as host, or from field extraction. Once available, fields can be used for filtering, calculations, sorting, and aggregation.

Limiting Results with head

The head command retains only the first specified number of results from the current pipeline stage.

index=main | head 50

The base search retrieves matching events from the main index. Then head 50 receives those events and retains 50 of them.

“First” depends on the current ordering. If no explicit ordering has been applied, do not assume that the first results represent the newest, oldest, or alphabetically smallest events.

Sorting Pipeline Results

The sort command orders the current result set by one or more fields. For example, this sorts by the commonly available host metadata field:

index=main | sort host

Ascending order is the default convention for a field sort. A descending sort can be requested with a minus sign before the field:

index=main | sort -host

When sorting by host does not produce useful results, check whether the field exists, was extracted correctly, and contains consistent values.

Why Command Order Matters

These two searches contain the same commands but can return different events:

index=main | head 50 | sort host

index=main | sort host | head 50

Use the first form when you want to inspect a limited set and then arrange it. Use the second when you want the first 50 results according to the sort order.

Building Multi-Command Searches

A pipeline can filter, calculate, and summarize data in sequence:

index=main | search status=error | eval is_error=if(status>=500, 1, 0) | stats sum(is_error) as error_count by host

• The base search retrieves events from main.
• search status=error narrows the current result set.
• eval creates the calculated field is_error.
• stats sums that field for each host.

A chart can also be a later stage:

index=main | chart count by host

Here, chart consumes the matching events and produces grouped, chart-oriented output. Charting is a processing stage after event retrieval, not part of the base search itself.

Fields and Time Range Context

The time range picker controls the event set available to the base search. Splunk applies that time constraint before downstream pipeline commands process the results. A correct pipeline cannot return events that the selected time range excluded.

Field availability also affects later stages. A field such as host may come from event metadata or field extraction. If it is missing, sorting, filtering, calculations, and aggregations that depend on it may fail or produce unexpected output.

• Use a time range broad enough to include the events you want to analyze.
• Confirm that the expected fields appear in the event results.
• Remember that commands such as stats transform events into summary rows, so later commands receive those rows rather than the original events.

Troubleshooting Piped Searches

The final results are not the expected 50 events

Check whether head comes before or after sort. head before sort limits the original result set; sort before head selects the first 50 results after ordering.

A downstream command returns no results

A command such as search status=error may remove every event from the current result set. Run the base search first, then add each command individually to find the stage that eliminates the events.

Sorting by host is unexpected

Confirm that host is present in the results and extracted as expected. Also verify the selected time range and inspect whether different events use inconsistent host values.

A calculated field is unavailable

Create the field with eval before the command that needs it. For example, place eval before sort, search, or stats when those stages depend on the calculated field.

Relevant events appear to be missing

Check the time range picker. Events outside the selected time window are excluded before pipeline processing begins. Adjust the time range and rerun the base search before diagnosing later commands.

Key Exam Notes

• The pipe character | connects stages in an SPL search.
• The command on the right receives the result set produced on the left.
• A search pipeline consists of a base search followed by zero or more processing commands.
• head 50 retains 50 results from the current ordering.
• sort host orders results by the host field; placing it before or after head changes which events are retained.
• The selected time range constrains the initial event set before downstream commands run.
• Fields must be available through metadata or field extraction before later commands can use them.

For a practical reference, see Splunk pipes and search pipelines.