Specifying import paths
When you import items or datasets with SPL2, the path that you specify to the item depends on your current location. You can specify the fully qualified path to the item or you can specify the relative path, based on your current module.
Consider the following image, which shows the emea
namespace. Within that namespace is a nested namespace germany
, which has a nested namespace munich
. Each of these namespaces have a module called response_team
.
In addition, the emea
namespace has a module called audit_team
. Under the germany
namespace there is an index called de_threats
. There is an import statement under the audit_team
module to import the de_threats
index. There is also an import statement under the germany response_team
module to import the de_threats
index.
The following table explains the path that you specify when importing datasets between the namespaces in this example:
Current module | Item | Item location | Type of path | Statement example |
---|---|---|---|---|
Any module in the emea namespace
|
de_threats index
|
germany namespace
|
Fully qualified path | import de_threats from /emea/germany |
response_team module in the germany namespace
|
de_threats index
|
germany namespace
|
Relative path | No import statement needed.
Datasets inside a namespace are automatically available to every module in that namespace. |
response_team module in the munich namespace
|
de_threats index
|
germany namespace
|
Relative path
Fully qualified path |
import de_threats from ../ This relative path specifies to go up one level from the current location.
import de_threats from /emea/germany |
response_team module in the munich namespace
|
emea_sites lookup
|
emea namespace
|
Relative path
Fully qualified path |
import emea_sites from ../../ This relative path specifies to go up two levels from the current location.
import emea_sites from /emea |
See also
Importing module items and datasets using SPL2 | Scope and precedence importing items |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!