into command syntax details
Syntax
The SPL2 into command supports different syntaxes in different product contexts.
Syntax for searches
In searches, the into command enables you to specify whether the data is appended or replaced to the dataset.
The required syntax is in bold.
- into
- [mode = (append | replace)]
- <dataset>
Syntax for pipelines
In pipelines, the into command is used to specify which destination dataset to append the data to.
The required syntax is in bold.
- | into <$destination>
Required arguments
The required arguments are different in each product contexts.
Searches
- dataset
- Syntax: <dataset>
- Description: This argument must be set to the name of a dataset that you have access to. This can be a dataset that you created or a dataset that you are authorized to use.
Pipelines
- destination
- Syntax: <$destination>
- Description: This argument must be set to the
$destinationparameter. The$destinationparameter refers to the destination dataset specified in the pipeline settings. See the Pipeline examples in theinto command examplestopic.
Optional arguments
- mode
- Syntax: mode=( append | replace )
- Description: Specifies whether to append results to or replace results in the specified dataset. The
modeonly applies to lookups in searches. - Default: append
See also
- into command
- into command overview
- into command usage
- into command examples
- Pipelines
- Edge Processor pipeline syntax in the Use Edge Processors manual
- Ingest Processor pipeline syntax in the Use Ingest Processors manual
- Related information
- Dataset kinds in the SPL2 Search Manual
Last modified on 08 January, 2025
| into command overview | into command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!