Using SPL commands in SPL2 searches

You can embed SPL commands in SPL2 by using the spl1 command, or you can convert SPL into SPL2 using a tool in the Search app or SPL2 module editor.

SPL2 directly supports the most common SPL commands, such as search, stats, eval, dedup, and lookup. These commands are documented in the SPL2 Search Reference. see Quick Reference for SPL2 commands.

For SPL commands that SPL2 doesn't support directly, there are several alternatives for using those SPL commands in SPL2.

Convert SPL to SPL2

In the Search & Reporting app and the SPL2 module editor, you can convert SPL searches, or snippets of SPL searches, into SPL2. For more information, see Convert a search from SPL to SPL2 in the SPL2 Search Manual.

Use the spl1 command

The spl1 command is a new command SPL2 that enables you to include SPL commands in your SPL2 searches. This is referred to as embedded SPL. You can use the spl1 command with many, but not all, of the SPL commands that are not supported directly in SPL2.

For a list of the SPL commands that you can embed in your SPL2 searching using the spl1 command, see spl1 command: Overview, syntax, and usage in the SPL2 Search Reference.

Note: The spl1 command is not supported with pipelines.

See also