Splunk® Data Stream Processor

Use the Data Stream Processor

Acrobat logo Download manual as PDF


On April 3, 2023, Splunk Data Stream Processor will reach its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Create a pipeline using the Data Stream Processor UI

To create a pipeline using the Data Stream Processor UI, perform the following steps.

  1. From the Data Stream Processor home page, click on Build pipeline.
  2. Click on a data source or on a template. If you select a data source, the canvas opens. If you select a template, choose the standard editor and skip to step 10.
  3. Add a name and a description to your pipeline by clicking the More options menu, and then select Update Pipeline Metadata. If you are creating a data pipeline from a different application, put the name of the application in the pipeline name or use the description field to say which application depends on this pipeline.
  4. Configure your source function. If you are using a connection-based function, create a connection before using this function. See get data in using a connector. In addition, some source functions have unique pipeline requirements. See the Unique pipeline requirements for specific data sources chapter in the left navigation bar.
  5. Click the + icon to add a function. A navigation bar on the right appears.
  6. Select a function from the navigation bar. For a full list of all functions available, see the Splunk DSP Function Reference manual.
  7. Enter the function attributes.
  8. Once at least one downstream function is defined, click the branch icon to send your data stream to a different downstream function.
  9. End your pipeline with a sink function.
  10. Click Validate to validate your pipeline. If you have any invalid functions, the first invalid function in your pipeline is highlighted in red and all subsequent functions are in an unsure state denoted by a question mark. Select the function and click the Preview Results tab. A sample of 100 events are sent through your pipeline. Use this to check and correct the function output.
  11. Click Save.
  12. (Optional) Click Activate to activate your pipeline. If it's the first time activating your pipeline, do not enable any of the optional Activate settings.
  13. Click the Data Management tab to go to the Data Management page. After saving your pipeline, use the Data Management page to edit, delete, clone, or activate your pipeline.

Edit a pipeline

You can edit your pipelines from the Data Management page.

  1. Click the Data Management tab to go to the Data Management page.
  2. Click Edit on the pipeline that you want to edit. If this pipeline is currently active, click on Edit to be taken to a copy of your active pipeline. Any changes you make are made on that copy and don't affect the active version of your pipeline. If this pipeline is currently inactive, any changes are made directly to your pipeline.
  3. Click Save to save changes to your pipeline.
  4. (Optional) Click Activate or Activate with changes to activate your pipeline. If you were working on a branch of an active pipeline, this updates the version of your current active pipeline to the latest version.

    If you are attempting to re-activate your pipeline and running into issues, you may want to update your activation checkpoint. See using activation checkpoints to activate your pipeline.

  5. Click the Data Management tab to return to the Data Management page. After saving your pipeline, use the Data Management page to edit, delete, clone, or activate your pipeline.
  6. (Optional) In the pipelines listing table, click the More Options menu, and select Upgrade to latest if you were editing a pipeline that is currently active. This updates your pipeline to the latest version. This may impact performance, but no data is lost during this process.
  7. (Optional) To see an overview of the current version of an active pipeline, click on the name of the pipeline.
Last modified on 07 January, 2020
PREVIOUS
Navigating the Data Stream Processor
  NEXT
Create a pipeline using a template

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters