Splunk® Data Stream Processor

Use the Data Stream Processor

DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.

Navigating the

When building a pipeline in the , you can choose to use the Canvas Builder or the SPL2 (Search Processing Language 2) Pipeline Builder. Each builder provides different features and tools for building a pipeline.

Use the Canvas Builder if you prefer to work in a graphical user interface (GUI) and receive more guidance as you work. Use the SPL2 Pipeline Builder instead if you prefer to write SPL2 statements to configure pipeline functions and define the structure of the pipeline. For more information on each builder, see Create a pipeline using the Canvas Builder and Create a pipeline using the SPL2 Pipeline Builder.

Canvas Builder

When creating a pipeline in the Canvas Builder, you click the point in the pipeline where you want to add a function and then select from a list that shows valid functions only. You then configure the function by filling in fields that show all the accepted arguments for that function. The Canvas Builder automatically supplies default values for any optional arguments that you do not fill in, and also provides streamlined workflows for more advanced pipeline features such as branches and unions.

The following screenshot shows the Canvas Builder.

This screenshot shows the Canvas Builder in Splunk Data Stream Processor. The Build Pipeline page is selected, and the Builder switch is set to Canvas. Specific UI elements are labeled with letters and numbers.

Label Element Description
A1 Home Navigate to the home page.
A2 Build Pipeline Create a new pipeline by selecting either a source function or a template.
A3 Data Management Navigate to a list of all pipelines, connections, and templates in your tenant.
A4 User Management Manage the users and administrators in your tenant.
A5 Help & Feedback Manage your product license, view details about the , and navigate to the documentation.
A6 Pipeline name The name of your pipeline.
A7 Pipeline state The state of your pipeline. For a list of available states and what they mean, see Check the status of a pipeline.
A8 Builder switch Toggle between the Canvas Builder and the SPL2 Pipeline Builder.

This feature is in BETA and repeated toggles can lead to unexpected results and even data loss.

A9 View/Edit View or edit an activated pipeline. Changes are not applied to the activated pipeline until you save and reactivate the pipeline.
A10 Save Save your pipeline.
A11 Activate Pipeline Activate your pipeline.
A12 More options Access additional options for working with your pipeline:
  • Validate the pipeline to confirm that your functions are configured correctly.
  • Save a copy of the pipeline.
  • Revert the pipeline to a previous version.
  • Deactivate the pipeline.
  • Delete the pipeline.
  • Update the pipeline metadata.
A13 Start Preview Preview the data moving through the selected function in your pipeline. See Test your pipeline configuration with preview sessions.
A14 Pipeline canvas The canvas view of your pipeline.
A15 Function The basic building block of a pipeline.
A16 Add a branch Create a branch in your pipeline, and add a function to the newly created branch.
A17 Add a function Add a function to your pipeline.
A18 Function metrics Live metrics about the function, such as the number of events moving in or out of the function per second. You can use these metrics to quickly scan if your records are making it through your pipeline or to check the performance of your pipeline.
A19 View Configurations View or modify the configuration of the selected function.
A20 Preview Results View a sample of the events that are sent through the selected function.

SPL2 Pipeline Builder

When creating a pipeline in the SPL2 Pipeline Builder, you write statements in SPL2 syntax to add functions and configure them. You can view the SPL2 statement of a pipeline to see an overview of all the arguments that have been specified for all the functions in the pipeline. You also have the option of copying SPL2 statements into text editors or other instances.

The following screenshot shows the SPL2 Pipeline Builder.

This screenshot shows the SPL2 Pipeline Builder in Splunk Data Stream Processor. The Build Pipeline page is selected, and the Builder switch is set to SPL. Specific UI elements are labeled with letters and numbers.

Label Element Description
B1 Home Navigate to the home page.
B2 Build Pipeline Create a new pipeline by selecting either a source function or a template.
B3 Data Management Navigate to a list of all pipelines, connections, and templates in your tenant.
B4 User Management Manage the users and administrators in your tenant.
B5 Help & Feedback Manage your product license, view details about the , and navigate to the documentation.
B6 Pipeline name The name of your pipeline.
B7 Pipeline state The state of your pipeline. For a list of available states and what they mean, see Check the status of a pipeline.
B8 Builder switch Toggle between the Canvas Builder and the SPL2 Pipeline Builder.

This feature is in BETA and repeated toggles can lead to unexpected results and even data loss.

B9 View/Edit View or edit an activated pipeline. Changes are not applied to the activated pipeline until you save and reactivate the pipeline.
B10 Save Save your pipeline.
B11 Activate Pipeline Activate your pipeline.
B12 More options Access additional options for working with your pipeline:
  • Save a copy of the pipeline.
  • Revert the pipeline to a previous version.
  • Deactivate the pipeline.
  • Delete the pipeline.
  • Update the pipeline metadata.
B13 SPL2 input field Enter an SPL2 statement that defines the functions and configurations in your pipeline.
B14 Rebuild pipeline Build the pipeline defined in your SPL2 statement, and validate the functions to confirm that they are configured correctly.
B15 Start Preview Preview the data moving through the selected function in your pipeline. See Test your pipeline configuration with preview sessions.
B16 Pipeline canvas The canvas view of your pipeline.
B17 Function The basic building block of a pipeline.
B18 Function metrics Live metrics about the function, such as the number of events moving in or out of the function per second. You can use these metrics to quickly scan if your records are making it through your pipeline or to check the performance of your pipeline.
B19 Preview Results View a sample of the events that are sent through the selected function.
Last modified on 07 January, 2021
About regular expressions   Create a pipeline using the Canvas Builder

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters