branch command overview
The SPL2 branch
command processes one set of events or search results, in parallel, simultaneous searches. Each search branch must end with the into
command.
Syntax
The required syntax is in bold.
- branch
- [<SPL-literal> | into <dataset>],
- [<SPL-literal> | into <dataset>] ...
How the SPL2 branch command works
Using the SPL2 branch
command, you can take one set of data and run multiple searches simultaneously against that data. The simultaneous searches are referred to as branches. The results of the searches are placed into separate lookup or splv1sink datasets, using the into
command. The data that you search can be events or search results.
Consider the following search. This search reads the events in the main
index dataset into memory one time. The events are then processed in two branches using subsearches to determine the most popular hosts and sources.
| from main
| branch
[stats count() BY host | where count > 50 select host | into p_hosts],
[stats count() BY source | where count > 100 select source | into p_sources]
- The first branch uses the
stats
command to count the events by host and returns only those hosts with a count above the threshold of 50. Using theinto
command, the results are appended to thep_hosts
dataset. - The second branch is similar. The
stats
command is used to count the events by source and returns only those sources with a count above the threshold of 100. Using theinto
command, the results are appended to thep_sources
dataset.
The branch
command does not return any results to the search endpoint. You must send the search results to a lookup or splv1sink dataset using the into
command. The into
must be the last command in each branch.
The data that you search can be events or search results. The previous example used events from the main
index. The following search uses the results returned from the beginning of a search and then processes that data in 3 branches.
| from my_dataset where earliest=-5m@m AND latest=@m
| branch
[stats avg(cpu_usage) BY host | where avg(cpu_usage) > 2000000 select host | into cpu_hosts],
[stats count() BY host | where count > 50 select host | into p_hosts],
[stats count() BY source | where count > 100 select source | into p_sources ]
In this example, the average and count aggregations must be calculated first, because the filtering, with the where
command, use those aggregations. In other situations, you might want to filter before the aggregations. See the branch command examples.
See also
- Other commands
- into command overview
- where command overview
bin command examples | branch command syntax details |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!