Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

into command overview

Appends to or replaces the contents of a dataset in the search data pipeline. The dataset must be a writeable dataset, also referred to as a dataset sink.

Syntax

The required syntax is in bold.

into
[ mode=append | replace ]
<dataset>

How the into command works

The into command does not return any results, so it must the last command in your search.

Let's start with this search:

FROM main WHERE earliest=-5m@m AND latest=@m GROUP BY host SELECT sum(bytes) AS sum, host HAVING sum > 1024*1024 | into bytesUsage

The following table describes what each command and clause is doing in the search:

Command or clause Description
FROM command Searches the main dataset.
WHERE clause Specifies to search only the last 5 minutes, starting at the beginning of the minute and stop at the beginning of the current minute.
GROUP BY clause Organizes the results by the host field.
SELECT clause Uses a calculation to sum the data in the bytes field and place the results in a field called sum. In addition, returns the host field.
HAVING clause Filters the aggregated results to return only the sum of the bytes that are greater than 1 MB.
into command Appends the results to the bytesUsage dataset.

By default, the into command appends search results to a lookup or splv1sink dataset that you have write access to. The mode argument is only valid when the dataset is a lookup kind of dataset. See Dataset kinds in the SPL2 Search Manual.

See also

into command
into command syntax details
into command usage
into command examples
Related commands
branch command overview
thru command overview
Related information
Dataset kinds in the SPL2 Search Manual
Last modified on 20 August, 2021
PREVIOUS
head command examples
  NEXT
into command syntax details

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters