Splunk® Cloud Services

SPL2 Search Reference

into command syntax details

Syntax

The SPL2 into command supports different syntaxes in different product contexts.

Syntax for searches

In searches, the into command enables you to specify whether the data is appended or replaced to the dataset.

The required syntax is in bold.

into
[mode = (append | replace)]
<dataset>

Syntax for pipelines

In pipelines, the into command is used to specify which destination dataset to append the data to.

The required syntax is in bold.

| into <$destination>

Required arguments

The required arguments are different in each product contexts.

Searches

dataset
Syntax: <dataset>
Description: This argument must be set to the name of a dataset that you have access to. This can be a dataset that you created or a dataset that you are authorized to use.

Pipelines

destination
Syntax: <$destination>
Description: This argument must be set to the $destination parameter. The $destination parameter refers to the destination dataset specified in the pipeline settings. See the Pipeline examples in the into command examples topic.

Optional arguments

mode
Syntax: mode=( append | replace )
Description: Specifies whether to append results to or replace results in the specified dataset. The mode only applies to lookups in searches.
Default: append

See also

into command
into command overview
into command usage
into command examples
Pipelines
Edge Processor pipeline syntax in the Use Edge Processors manual
Ingest Processor pipeline syntax in the Use Ingest Processors manual
Related information
Dataset kinds in the SPL2 Search Manual
Last modified on 08 January, 2025
into command overview   into command usage

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters