Splunk® Data Stream Processor

Use the Data Stream Processor

DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.

Test your pipeline configuration with preview sessions

When creating a data pipeline in the , you can start a preview session to see the results of the data transformations defined in your pipeline without having to send data all the way through to a destination. You can start a preview session on an inactive or incomplete pipeline, send data to that pipeline, and then view the Preview Results tab. The Preview Results tab shows the output of the function that you have selected, so you can click through the functions in your pipeline to see how your data is being transformed every step of the way.

You can also start preview sessions when editing an active pipeline. In this case, the pipeline continues to transform data and send it to the destination based on the original configuration, while the preview session shows how your edited pipeline would transform the data if you save your changes and reactivate the pipeline.

Before activating a pipeline or saving changes to an active pipeline, verify that your data is being transformed as expected.

Preview data is not available for sink functions or the Write thru KV Store function. To see the output of those functions, you must preview the output of the pipeline function located immediately before the sink function or Write thru KV Store function.

See the Monitoring chapter in the Install and administer the manual for information about how to monitor active pipelines using the Splunk App for DSP.

You cannot start a preview session for any pipelines containing 100 or more functions.

How preview sessions work

When you start a preview session, the starts polling for any data sent to the pipeline. The preview session continues until you stop it, or until 15 minutes have passed. During the preview session, the does the following:

  • Collects metrics every second, and shows the most recent numbers in the pipeline functions on the canvas. You can use these metrics to monitor the performance of your pipeline.
  • Samples records from the incoming data, and displays them on the Preview Results tab. The samples up to 100 records for each function in the pipeline. On the Preview Results tab, you can view details such as the schema of the record and the data type and value of each field in the record.

See Navigating the for more information about the UI, including examples of how these metrics and sampled records are displayed during preview sessions.

Some data source functions support the initial_position parameter, which determines the location in the data stream where the starts reading data. If initial_position is set to LATEST, then the samples events starting from the latest position in the data stream. If initial_position is set to TRIM HORIZON, then the samples events starting from the very beginning of the data stream.

Preview the data streaming through a pipeline

  1. Open the pipeline that you want to preview.
  2. If the pipeline is active, click Edit to enter the pipeline editing view.
  3. On the pipeline canvas, select a function other than the sink function, and then click Start Preview.
    DSP automatically navigates to the Preview Results tab, which displays the message Polling for preview data once the preview session has started.
  4. If data is not already being sent to your pipeline, send some data now. If you are using the Splunk DSP Firehose or Ingest Service source functions, you can follow the instructions in Use the Ingest service to send test events to your pipeline.
    After a few seconds, the functions on the canvas start to display metrics indicating the flow of data through the pipeline, and the Preview Results tab starts displaying the data that you sent.
  5. (Optional) Click each function and check the Preview Results tab to see how your data gets transformed as a result of each function in your pipeline. On the Preview Results tab, you can do any of the following:
    • Choose to view your records using a Table format, a List format, or as Raw text. In the Table view, you can do the following:
      • Click and drag the field headings to change how they are ordered in the preview. Changing the order of the fields in the preview does not have any impact on the actual records.
      • Check the symbols beside each field name to confirm the data type of the field. See the tables in data types for information about the data type indicated by each symbol.
    • Choose the number of records to display per page.
    • Enter a filter value so that the Preview Results tab only displays records that contain that value.
  6. (Optional) Click Stop Preview.

See also

Last modified on 11 March, 2022
Use the Ingest service to send test events to your pipeline   Masking sensitive data in the

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters