branch command syntax details
Syntax
The SPL2 branch command supports different syntaxes in different product contexts.
Syntax for searches
In searches, the into command at the end of each branch must specify the name of the dataset that you want to send the results to.
The required syntax is in bold.
- branch
- [[<additional-SPL2-commands>] | into [mode = (append | replace)] <dataset>],
- [[<additional-SPL2-commands>] | into [mode = (append | replace)] <dataset>] ...
Each branch is enclosed in square brackets and separated by commas.
Syntax for pipelines
In pipelines, the into command at the end of each branch must specify the $destination parameter. This parameter refers to the destination dataset specified in the pipeline settings, and determines which destination dataset the results of the branch are sent to.
The required syntax is in bold.
- branch
- [[<additional-SPL2-commands>] | into <$destination>],
- [[<additional-SPL2-commands>] | into <$destination>] ...
Each branch is enclosed in square brackets and separated by commas.
Required arguments
The required arguments are different in each product context.
Searches
- dataset
- Syntax: <dataset-name>
- Description: The name of the dataset to write the search results to. This can be a dataset that you created or a dataset that you are authorized to use.
Pipelines
- dataset
- Syntax: <$destination>
- Description: This argument must be set to the
$destinationparameter. The$destinationparameter refers to the destination dataset specified in the pipeline settings. See the Pipeline examples on the branch command examples topic.
Optional arguments
The required arguments are different in each product context.
Searches
- additional-SPL2-commands
- Syntax: <additional-SPL2-commands>
- Description: One or more SPL2 commands to process the data before it is written to the <dataset>. See the Specifying filters examples on the branch command examples topic.
- mode
- Syntax: mode=( append | replace )
- Description: Specifies whether to append results to or replace results in the specified dataset. The replace setting only applies to lookup datasets.
- Default: append
Pipelines
- additional-SPL2-commands
- Syntax: <additional-SPL2-commands>
- Description: One or more SPL2 commands to process the data before it is routed to the <$destination>. See the Pipeline examples on the branch command examples topic.
See also
- branch command
- branch command overview
- branch command usage
- branch command examples
- Related information
- Dataset kinds in the SPL2 Search Manual
| branch command overview | branch command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!