thru command overview
The SPL2 thru command writes data to a writeable dataset and then passes the same data to the next command in the search string. By default, the thru command appends data to the dataset.
Syntax
The SPL2 thru command supports different syntaxes in different product contexts.
Syntax for searches
In searches, the thru command enables you to specify whether to append results to or replace results in the specified dataset.
The required syntax is in bold.
- thru
- [mode = (append | replace)]
- <dataset>
Syntax for pipelines
In pipelines, the thru command is used for data routing, and the routed copy of the data is always appended to the destination dataset.
The required syntax is in bold.
- thru
- [
- [<additional-SPL2-commands>]
- | into <destination>
- ]
The outermost square brackets [ ] are required.
See also
- Related information
- into command overview
Last modified on 09 January, 2025
| streamstats command examples | thru command syntax details |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!