The three components are: search terms (to retrieve events), commands (to transform or filter data), and functions/arguments (to define how commands operate). Commands are separated by the pipe (`|`) character.