Using SPL command functions
To use the SPL command functions, you must first import the functions into a module. See Importing SPL command functions.
After the command functions are imported, you can use the functions in the searches in that module. There are two types of command functions: generating and non-generating:
- Generating commands are invoked at the beginning of a search
- Non-generating commands are invoked after the first command in a search
Generating command functions
To use a generating command function in an SPL2 module, specify pipe character ( | ), then the name of the function and the values for the function parameters.
Here are a few examples:
| makeresults count=4 <parameters>
| tstats aggregates=[count()] byfields=[source]
Non-generating command functions
For non-generating command functions, you use the function after you specify the dataset.
You can use both SPL2 commands and SPL command functions in the same search. For example, in the following search the SPL2
eval commands are used to search for IP addresses in the events and to classify the network that the addresses belong to. The
table command function is used at the end of a search to display the search results:
| dedup clientip
| eval network=if(cidrmatch("188.8.131.52/16", clientip), "local", "other")
| table clientip, network
- Related information
- Compatibility library for SPL commands as functions
Importing SPL command functions
Overview of SPL2 eval functions
This documentation applies to the following versions of Splunk® Cloud Services: current