# Learning Journey: Splunk Search Processing Language (SPL)

## Goal
Master Splunk SPL for complex, high-performance querying and data analysis.

## Core Pillars
1. **Search Lifecycle & Processing**: Understanding the "Filter Early, Calculate Late" rule.
2. **Streaming vs. Non-Streaming**: Pipeline execution and command types.
3. **Data Summarization**: Using `tstats` and data models for massive datasets.
4. **Join-less Architectures**: Replacing `join` and subsearches with `stats` and `lookup`.

## Progress Log
- [ ] **Level 1: The Golden Rule (Filtering)**
- [ ] **Level 2: Streaming & Execution Paths**
- [ ] **Level 3: Advanced Stats & Lookups**
- [ ] **Level 4: Metadata Mastery (tstats)**