thru command overview
The SPL2 thru
command writes data to a writeable dataset and then passes the same data to the next command in the search string. By default, the thru
command appends data to the dataset.
Syntax
The SPL2 thru
command supports different syntaxes in different product contexts.
Syntax for searches
In searches, the thru
command enables you to specify whether to append results to or replace results in the specified dataset.
The required syntax is in bold.
- thru
- [mode = (append | replace)]
- <dataset>
Syntax for pipelines
In pipelines, the thru
command is used for data routing, and the routed copy of the data is always appended to the destination dataset.
The required syntax is in bold.
- thru
- [
- [<additional-SPL2-commands>]
- | into <destination>
- ]
The outermost square brackets [ ] are required.
See also
- Related information
- into command overview
streamstats command examples | thru command syntax details |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!