[outputtelemetry-command] syntax = outputtelemetry (input=) (type=)? (component=)? (support=)? (anonymous=)? (license=)? (optinrequired=)? shortdesc = Outputs search results to telemetry endpoint. description = Outputs search results to telemetry endpoint. \ Required field “input” will have the endpoint payload. \ The other fields “component”, “type”, “optinrequired” \ are optional fields but the endpoint expects them to be supplied either with the search command \ or to be found in the event data.\ Visibility fields "anonymous", "license" and "support" are optional. example1 = ... fields data | outputtelemetry input=data component=my.telemetry type=event anonymous=true optinrequired=2 comment1 = Output search results to the telemetry endpoint, using the field named "data."" Each will be \ named "my.telemetry" and is described as a singular "event" type. The telemetry event will only be \ sent if the deployment has been opted in to share Anonymized usage data, with opt-in version of 2. usage = internal tags = output telemetry category = results::write [makejson-command] syntax = makejson (output=) shortdesc = Combines specified fields into a stringified JSON description = Combines the specified set of field names, or field name patterns, \ and creates an field with the output name. example1 = ... | makejson name data.* "counts[float]" output=json_event comment1 = Create a stringified JSON: { "name": "", "data": { "count": , "metrics": [values of data.metrics] }} usage = internal tags = json category = results::filter