Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Overview of SPL2 dataset functions

There are two types of dataset functions:

  • Generating dataset functions are functions that create events to form a dataset
  • Sink dataset functions are functions that consume events from a dataset

Some dataset functions can be used with any generating command. Other dataset functions are designed to be used only with a specific command.

Dataset function Description Function type
indexes Use this function to map to the indexes that you have permission to access.

This function is used with any generating command, such as the from, join, and union commands.

generating
repeat Use this function to create events in a temporary dataset. The SPL2 repeat() dataset function is similar to the SPL makeresults command.

This function is used with any generating command, such as the from, join, and union commands.

generating

Naming function arguments

When you use a function, you can include the names of the function arguments in your search.

Naming function arguments is optional, but makes it clear which argument each function value applies to. Using named arguments is especially useful when the function includes optional arguments or arguments that have the same data type.

For example, the syntax for the actions() function is ...| into actions(<trigger>,<trigger-once>,[<filter-condition>],[<metadata>]). The [<filter-condition>] and [<metadata>] arguments are optional.

An example of using this function is this:

...| into actions(mytrigger, true, error=500, {locale: "en_AU", city: "Sydney"})

To name the arguments, you would specify this:

...| into actions(trigger: mytrigger, trigger-once: true, filter-condition: error=500, metadata: {locale: "en_AU", city: "Sydney"})


  • Argument names are separated from argument values by a colon ( : )
  • If an argument can accept a list of values, you must enclose the list in square brackets ( [ ] ).
  • Named arguments can appear in any order.
  • You can choose to name only some of the arguments. However, named arguments must appear after unnamed arguments.

The following table shows valid and invalid named argument syntax for the actions and indexes functions:

Valid syntax Invalid syntax
Required arguments only

....| into actions(mytrigger, true)

Missing a required argument

...| into actions(true, error=500, {locale: "en_AU", city: "Sydney"})

All arguments

...| into actions(mytrigger, true, error=500, {locale: "en_AU", city: "Sydney"})

Named required argument

...| into actions(trigger: mytrigger, trigger-once: true)

Named all arguments

...| into actions(trigger: mytrigger, trigger-once: true, filter-condition: error=500, metadata: {locale: "en_AU", city: "Sydney"})

Name arguments in any order

...| into actions(trigger-once: true, filter-condition: error=500, trigger: mytrigger, metadata: {locale: "en_AU", city: "Sydney"})

Not all arguments need to be named, but named arguments must follow unnamed arguments

...| into actions(mytrigger, error=500, trigger-once: true, metadata: {locale: "en_AU", city: "Sydney"})

Named arguments cannot come before unnamed arguments

...| into actions(trigger: mytrigger, trigger-once: true, error=500, metadata: {locale: "en_AU", city: "Sydney"})

Multiple values for an argument in square brackets

| FROM indexes(patterns: ['data1*', 'data2*'])

See also

Related information
Datasets in the SPL2 Search Manual.
Functions
Overview of SPL2 statistical and charting functions
Overview of SPL2 eval functions
Last modified on 11 August, 2021
PREVIOUS
Time functions
  NEXT
indexes dataset function

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters