Splunk® Cloud Services

SPL2 Search Reference

Using SPL command functions

To use the SPL command functions, you must first import the functions into a module. See Importing SPL command functions.

After the command functions are imported, you can use the functions in the searches in that module. There are two types of command functions: generating and non-generating:

  • Generating commands are invoked at the beginning of a search
  • Non-generating commands are invoked after the first command in a search

Generating command functions

To use a generating command function in an SPL2 module, specify pipe character ( | ), then the name of the function and the values for the function parameters.

Here are a few examples:

| makeresults count=4 <parameters>

| tstats aggregates=[count()] byfields=[source]

Non-generating command functions

For non-generating command functions, you use the function after you specify the dataset.

You can use both SPL2 commands and SPL command functions in the same search. For example, in the following search the SPL2 from, dedup, and eval commands are used to search for IP addresses in the events and to classify the network that the addresses belong to. The table command function is used at the end of a search to display the search results:

from sample_events | dedup clientip | eval network=if(cidrmatch("108.65.0.0/16", clientip), "local", "other") | table clientip, network

See also

Related information
Compatibility library for SPL commands as functions
Last modified on 13 April, 2023
Importing SPL command functions   Overview of SPL2 eval functions

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters