Structure of DSP function descriptions
The following list provides an overview of how the information about each DSP function is presented in this manual.
Some sections are applicable only to specific categories of functions. See DSP functions by category for more information about each category.
- Describes what the function does. This section includes details about how to use the function. For more complex functions, further details and examples might be provided in a separate Usage section.
- Describes any configurations that must be completed before you can use the function.
- Function input
- Describes the data that the function accepts as input. For example, some functions accept only string values, and others accept timestamp values in a specific syntax. In some cases, the function input is
collection<record<R>>, which means that data enters the function as a collection of records with schema <R>. A collection is a list of records.
- Function output
- Describes the data type or syntax of the data that the function emits as output. In some cases, the function output is
collection<record<S>>, which means that data exits the function as a collection of records with schema <S>. A collection is a list of records.
- Describes the accepted syntax for specifying all the arguments for the function. Applicable only to streaming functions. Required arguments are shown in bold and enclosed in angle brackets ( < > ). Optional arguments are enclosed in square brackets ( [ ] ). Some functions have arguments that accept only a specific set of options. These sets of options are listed in the appropriate argument description under Required arguments or Optional arguments.
- Required arguments
- Describes the required arguments, including the supported syntax and examples for each argument.
- Optional arguments
- Describes the optional arguments, including the supported syntax and examples for each argument. Default values, if applicable, are also listed.
- Contains additional information about how to use the function.
- SPL2 example
- Contains examples of how to use the function. Because scalar functions operate in the context of streaming functions, the scalar function examples might include a streaming function that it's operating within. For instance, an example for the
castscalar function might be
| eval body=cast(body, "string"). This example shows the
castscalar function being used within an
DSP functions by category
Aggregate with Trigger
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0
Feedback submitted, thanks!