Splunk® Data Stream Processor

Function Reference

On April 3, 2023, Splunk Data Stream Processor reached its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 in order to continue to receive full product support from Splunk.

Structure of DSP function descriptions

The following list provides an overview of how the information about each DSP function is presented in this manual.

Some sections are applicable only to specific categories of functions. See DSP functions by category for more information about each category.

Describes what the function does. This section includes details about how to use the function. For more complex functions, further details and examples might be provided in a separate Usage section.
Describes any configurations that must be completed before you can use the function.
Function input
Describes the data that the function accepts as input. For example, some functions accept only string values, and others accept timestamp values in a specific syntax. In some cases, the function input is collection<record<R>>, which means that data enters the function as a collection of records with schema <R>. A collection is a list of records.
Function output
Describes the data type or syntax of the data that the function emits as output. In some cases, the function output is collection<record<S>>, which means that data exits the function as a collection of records with schema <S>. A collection is a list of records.
Describes the accepted syntax for specifying all the arguments for the function. Applicable only to streaming functions. Required arguments are shown in bold and enclosed in angle brackets ( < > ). Optional arguments are enclosed in square brackets ( [ ] ). Some functions have arguments that accept only a specific set of options. These sets of options are listed in the appropriate argument description under Required arguments or Optional arguments.
Required arguments
Describes the required arguments, including the supported syntax and examples for each argument.
Optional arguments
Describes the optional arguments, including the supported syntax and examples for each argument. Default values, if applicable, are also listed.
Contains additional information about how to use the function.
SPL2 example
Contains examples of how to use the function. Because scalar functions operate in the context of streaming functions, the scalar function examples might include a streaming function that it's operating within. For instance, an example for the cast scalar function might be | eval body=cast(body, "string"). This example shows the cast scalar function being used within an eval streaming function.
Last modified on 14 April, 2021
functions by category   Aggregate with Trigger

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters