thru command examples
The following are examples for using the SPL2
To learn more about the
thru command, see How the thru command works.
1. Append all of the search results to a dataset
This example appends all the incoming search result set to the
actions dataset. Those same search results are also passed into the
... | thru actions | eval field=<expression>
2. Replace all of the search results in a dataset
In this example, all of the existing data in the
customers dataset is replaced by the incoming search result set. Those same search results are passed into the
... | thru mode=replace customers | eval field=<expression>
thru command usage
timechart command overview
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!