transforming command

transforming command


A type of search command that orders the results into a data table. Transforming commands "transform" the specified cell values for each event into numerical values that Splunk Enterprise can use for statistical purposes. Searches that use transforming commands are called transforming searches.

Transforming commands include chart, timechart, stats, top, rare, contingency, and highlight.

Transforming commands are required to transform search result data into the data structures required for visualizations such as column, bar, line, area, and pie charts.

Note: In earlier versions of Splunk Enterprise, transforming commands were referred to as "reporting commands."

For more information

In the Search Manual:

In the Search Reference:

In Dashboards and Visualizations: