> For the complete documentation index, see [llms.txt](https://baric6.gitbook.io/barics-knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://baric6.gitbook.io/barics-knowledge-base/development/siems-and-edr/splunk/data-searches/spl-breakdown.md).
# SPL Breakdown
### Comparison Operators
|
This operator is used to match values against the field. In this example, it will look for all the events, where the value of the field UserName is equal to Mark.
|
|
Not Equal to
|
!=
| UserName!=Mark |
This operator returns all the events where the UserName value does not match Mark.
|
|
Less than
|
<
| Age < 10 |
Showing all the events with the value of Age less than 10.
|
|
Less than or Equal to
|
<=
| Age <= 10 | Showing all the events with the value of Age less than or equal to 10. |
|
Greater than
|
>
|
Outbound\_traffic > 50 MB
|
This will return all the events where the Outbound traffic value is over 50 MB.
|
|
Greater Than or Equal to
|
>=
| Outbound\_traffic >= 50 MB | This will return all the events where the Outbound traffic value is greater or equal to 50 MB. |
### Boolean Operators
|
Ignore the events from the result where field\_A contain the specified value.
|
|
OR
|
field\_A=value1 OR field\_A=value2
|
Return all the events in which field\_A contains either value1 or value2.
|
|
AND
| field\_A=value1 AND field\_B=value2 | Return all the events in which field\_A contains value1 and field\_B contains value2. |
### Wild Card
| Wildcard symbol |
|
### Fields
### Search
### Dedup
The command used to remove duplicate fields from the search results. We often get the results with various fields getting the same results. These commands remove the duplicates to show the unique values.
### Rename
### Table
### Head
The head command returns the first 10 events if no number is specified.
### Tail
The Tail command returns the last 10 events if no number is specified.
### Sort
### Reverse
The reverse command simply reverses the order of the events.
### Top
This command returns frequent values for the top 10 events.
### Rare
This command does the opposite of top command as it returns the least frequent values or bottom 10 results.
### Highlight
The highlight command shows the results in raw events mode with fields highlighted.
### Stats
|
| This command is used to calculate the average of the given field. | stats avg(field\_name) | stats avg(product\_price) |
|
Max
| It will return the maximum value from the specific field. | stats max(field\_name) | stats max(user\_age) |
|
Min
| It will return the minimum value from the specific field. | stats min(field\_name) | stats min(product\_price) |
|
Sum
| It will return the sum of the fields in a specific value. | stats sum(field\_name) |
stats sum(product\_cost)
|
|
Count
| The count command returns the number of data occurrences. | stats count(function) AS new\_NAME | stats count(source\_IP) |
### Chart
The chart command is used to transform the data into tables or visualizations.
### Timechart
The timechart command returns the time series chart covering the field following the function mentioned. Often combined with STATS commands.
