Splunk® Cloud Services

SPL2 Search Reference

branch command syntax details


The required syntax is in bold.

[<SPL-literal> | into <dataset> ],
[<SPL-literal> | into <dataset> ] ...

Each branch is enclosed in square brackets and separated by commas.

Required arguments

Syntax: <SPL-literal>
Description: A snippet of fully-formed SPL that is complete enough to be run as a separate search.
Syntax: <dataset-name>
Description: The name of a lookup or splv1sink dataset. This can be a new dataset or an existing dataset. By default the into command appends the search results to the dataset. To replace the data in the dataset with the data from the search, you must use the mode=replace argument with the into command. The mode only applies to lookups. The mode is not used with datasets where the kind of dataset is spl1sink.

Optional arguments


See also

branch command
branch command overview
branch command usage
branch command examples
Related information
Dataset kinds in the SPL2 Search Manual
Last modified on 20 August, 2021
branch command overview   branch command usage

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters