branch command usage
You can use the first command in a branch to specify condition or filters for that branch, for example:
| from people
| branch
[where (age < 13 ) | stats count() BY firstname | into child_names],
[where gender = "M" | stats count() BY firstname | into male_names],
[where gender = "F" | stats count() BY firstname | into female_names],
[stats count() BY firstname | into names]
This search loads all of the people into memory and then sends those events down 4 branches.
- The first 3 branches use the
where
command to filter the events for people in particular groups (children, men and women) and then calculates thecount
using thestats
command. - The last branch does not specify a filter before the
stats
command.
See also
branch command syntax details | branch command examples |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!