Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

repeat dataset function

Use the repeat() function to create events in a temporary dataset. The repeat() function is often used to create events for testing. You can use the repeat function anywhere you can specify a dataset name, for example with the FROM, union, and join commands.

The SPL2 repeat() dataset function is similar to the makeresults command in SPL.

Syntax

The required syntax is in bold.

repeat (<object>, <integer>)

The arguments must be enclosed in parentheses ( ).


Required arguments

object
Syntax: <object>
Description: Either an empty object { } or a single JSON object, in the format {field: value}. Field names that contain characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single quotation marks. This includes field names with spaces. String values must be enclosed in double quotation marks.
integer
Syntax: <integer>
Description: The number of events to create.

Optional arguments

None

Usage

The repeat() function is a generating function. Generating functions are functions that create events to form a dataset.

There are some limitations using the repeat function:

  • You can't specify nested JSON objects with the repeat dataset function.
  • You can't specify an array of JSON objects. You can only specify a single JSON object with multiple field-value pairs.

To use named arguments, you must specify the argument names before the argument values. For example:

...repeat(template:{'city-name': "San Francisco"}, count:2)

Should I use the repeat function or a dataset literal?

The repeat function is a very useful method to create a temporary dataset in certain circumstances. An alternative to the repeat function is to use a dataset literal. See Dataset literals in the SPL2 Search Manual.

The following table describes the usage differences and limitations between the repeat function and a dataset literal:

Method Usage Limitations
repeat function Use the repeat function when you want to create multiple identical, or nearly identical events, where only a few values are different. You can use the repeat function to create a lot of events quickly. You can't use nested objects or an array of objects with the repeat function.
dataset literal Use a dataset literal when you want to create events with many different values. You can use nested objects and arrays in a dataset literal. Manually typing in each of the objects is time-consuming. You can't use an empty object with a dataset literal. See Sample dataset literals in the SPL2 Search Manual.

Examples

These examples show different ways to use the repeat function to create events.

1. Create a dataset with empty events

You can create a dataset of empty events. Each event contains the _time field, which contains the timestamp when the event was created. For example, to create a dataset with 5 events use this search:

FROM repeat({}, 5)

The results look something like this:

_time
2020-03-20 14:35:58
2020-03-20 14:35:58
2020-03-20 14:35:58
2020-03-20 14:35:58
2020-03-20 14:35:58

Each event has the exact same timestamp.

2. Create events with hourly or daily timestamps

There are many things you can do to extend the events you create.

For example, you can create a set of hourly timestamps instead of events with the exact same timestamp. Add the streamstats command to create a count of the events. Use the eval command to create incremental timestamps by multiplying the count by 3600, the number of seconds in an hour.

| FROM repeat({}, 5) | streamstats count() | eval _time=_time-(count*3600)

The results look something like this:

_time count
2020-03-20 15:35:14 1
2020-03-20 14:35:14 2
2020-03-20 13:35:14 3
2020-03-20 12:35:14 4
2020-03-20 11:35:14 5

The hours in the timestamp are 1 hour apart, starting with the latest timestamp and ending with the earliest timestamp.

To create daily timestamps, use 86400, the number of seconds in a day, in the eval command.

3. Create events with a field-value object

You can specify a JSON object to create a field in the events in the dataset.

| from repeat({'city-name': "San Francisco"},2)

Because the field city-name contains a dash ( - ), the name must be enclosed in single quotation marks. The value San Francisco is a string, which must be enclosed in double quotation marks.

The results look something like this:

_time city-name
03-20-2020 14:35:58.000 PM San Francisco
03-20-2020 14:35:58.000 PM San Francisco

4. Create events with multiple fields

This example shows how to specify multiple key-value pairs in a JSON object, which results in multiple, duplicate fields in each event in the dataset.

| from repeat({host: "www1", sourcetype: "access_combined"},3)

The results look something like this:

_raw _time host sourcetype
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www1 access_combined
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www1 access_combined
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www1 access_combined

You can alter the duplicate events by adding the streamstats command to create a count of the events. Use the eval command to alter an event by the count number.

For example, this search alters the value of the host field for the second event:

| from repeat({host: "www1", sourcetype: "access_combined_wcookie"},3) | streamstats count() | eval host = if(count=2, "www2", host)

The results look something like this:

_raw _time host sourcetype count
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www1 access_combined 1
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www2 access_combined 2
{host: "www1", sourcetype: "access_combined"} 03-20-2020 14:35:58.000 PM www1 access_combined 3

See also

Related information
eval command overview
from command overview
streamstats command overview
Last modified on 22 September, 2021
PREVIOUS
indexes dataset function
  NEXT
Custom eval functions

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters