sdselect command overview
Use the sdselect
command to run federated searches against Amazon S3 datasets that are referenced by AWS Glue Data Catalog tables.
Syntax
The required syntax is in bold.
- | sdselect
- [reuse_search_results=<bool>]
- ( <field-list> | <stats-func>)...
- <from-clause>
- [WHERE <eval-expression>]
- [GROUPBY (<field-list> [span=[<unsigned_int>]<timescale>])]
- [ORDERBY <field-list>]
- [LIMIT <unsigned_int>]
See also
Give your users role-based access control of federated indexes | sdselect command syntax details |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403
Feedback submitted, thanks!