Splunk® Data Stream Processor

Function Reference

Acrobat logo Download manual as PDF


DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
Acrobat logo Download topic as PDF

Structure of DSP function descriptions

The following list provides an overview of how the information about each DSP function is presented in this manual.

Some sections are applicable only to specific categories of functions. See DSP functions by category for more information about each category.

Description
Describes what the function does. This section includes details about how to use the function. For more complex functions, further details and examples might be provided in a separate Usage section.
Prerequisites
Describes any configurations that must be completed before you can use the function.
Function input
Describes the data that the function accepts as input. For example, some functions accept only string values, and others accept timestamp values in a specific syntax. In some cases, the function input is collection<record<R>>, which means that data enters the function as a collection of records with schema <R>. A collection is a list of records.
Function output
Describes the data type or syntax of the data that the function emits as output. In some cases, the function output is collection<record<S>>, which means that data exits the function as a collection of records with schema <S>. A collection is a list of records.
Syntax
Describes the accepted syntax for specifying all the arguments for the function. Applicable only to streaming functions. Required arguments are shown in bold and enclosed in angle brackets ( < > ). Optional arguments are enclosed in square brackets ( [ ] ). Some functions have arguments that accept only a specific set of options. These sets of options are listed in the appropriate argument description under Required arguments or Optional arguments.
Required arguments
Describes the required arguments, including the supported syntax and examples for each argument.
Optional arguments
Describes the optional arguments, including the supported syntax and examples for each argument. Default values, if applicable, are also listed.
Usage
Contains additional information about how to use the function.
SPL2 example
Contains examples of how to use the function. Because scalar functions operate in the context of streaming functions, the scalar function examples might include a streaming function that it's operating within. For instance, an example for the cast scalar function might be | eval body=cast(body, "string"). This example shows the cast scalar function being used within an eval streaming function.
Last modified on 14 April, 2021
PREVIOUS
DSP functions by category
  NEXT
Adaptive Thresholding (beta)

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters