
thru command examples
The following are examples for using the SPL2 thru
command.
To learn more about the thru
command, see How the thru command works.
1. Append all of the search results to a dataset
This example appends all the incoming search result set to the actions
dataset. Those same search results are also passed into the eval
command.
... | thru actions | eval field=<expression>
2. Replace all of the search results in a dataset
In this example, all of the existing data in the customers
dataset is replaced by the incoming search result set. Those same search results are passed into the eval
command.
... | thru mode=replace customers | eval field=<expression>
See also
PREVIOUS thru command usage |
NEXT timechart command overview |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!