SPL2 compatibility profiles
The Search Processing Language, version 2 (SPL2) is a product-agnostic language that supports both SPL and SQL syntax patterns. SPL2 is designed to serve as the single entry point to the Splunk portfolio.
Each product or feature that implements SPL2 might support a subset of the commands and functions that are available in the language, based on what the product or feature is designed to do. When an SPL2 command or function is used, the SPL2 syntax is used. The syntax does not change for that product or feature.
An SPL2 profile maps to a set of SPL2 commands and functions that are used by a given product or feature.
Current SPL2 profiles
The following table lists the Splunk products and the associated SPL2 profiles:
| Splunk product or feature | Profile name | Related information |
|---|---|---|
| Splunk Edge Processor | edgeProcessor | |
| Splunk Ingest Processor | ingestProcessor | |
| Splunk Edge Processor (Search tab only) | splunkd | |
| Search app | splunkd |
|
| Application development | splunkd |
|
| Federated search | federatedSearch |
Federated search profile
The federatedSearch profile is used for searching against remote datasets stored in 3rd party locations such as Amazon S3 buckets or Microsoft Azure Blob Storage containers.
On Splunk Cloud Platform, you can use SPL2 to write federated searches that query federated datasets stored in remote 3rd party locations such as Amazon S3 buckets or Microsoft Azure Blob Storage containers. These federated searches use the federatedSearch profile to parse the search.
About the federated search profile
The federatedSearch profile is different than other SPL2 compatibility profiles. When a federated search is run, some of the commands and functions are processed locally on your Splunk deployment and some are processed remotely on the data source.
The parts of the search that are processed remotely is determined when the federated search is run, and is based on the capabilities of the remote data source. For federated searches, every attempt is made to process as much of the search as possible remotely.
Federated search resources
-
For a list of the data sources that are supported by federated search, see Overview of the federated search options for the Splunk platform.
-
To learn how to write SPL2-based federated searches, see Write and run federated searches over federated datasets with SPL2.
-
For a list of the ways that SPL2 behaves differently with federated searches, see Federated search limitations.