Comment by munk-a

I don't buy that, splunk has a clear concept of columns and rows and could have chosen to expose support for a SQL like grammar for assembling them - they instead chose a less structured format that makes data assembly quite difficult.

More legitimately splunk may simply be unable to deliver performant data expression if a user is typing a query complex enough to justify SQL.