appendpipe command: Overview, syntax, and usage
The SPL2 appendpipe command appends the result of the subpipe to the search results. Unlike a subsearch, the subpipe is not run first.
The SPL2 appendpipe command appends the result of the subpipe to the search results. Unlike a subsearch, the subpipe is not run first. The subpipe is run when the search reaches the appendpipe command.
If your search uses a transforming command such as stats or timechart. the appendpipe command must be placed after the transforming command in the search. Transforming commands produce a table or summary of information that the subpipe values can be appended to.
Syntax
The required syntax is in bold.
appendpipe
run_in_preview=boolean
[subpipe]
Required arguments
subpipe
Syntax: [command | command ...]
Description: A series of commands that are applied to the search results that are piped into the appendpipe command. The subpipe must be enclosed in square brackets.
Optional arguments
run_in_preview
Syntax: run_in_preview=boolean
Description:
Specifies whether or not to display the impact of the appendpipe command while the search is running. When set to false, the impact of the command on the search results appears only after the search has finished running.
Default: true
Usage
The appendpipe command can be useful when you are constructing a table or chart because it provides a summary, total, or otherwise descriptive row for each component of the result set. This command is also useful when you need the original results for additional calculations.
See also
appendpipe command