Documentation > Splunk > Release Notes > Real-time search, reports, and dashboards

Release Notes

 


What's new
Known issues for this release
Changelogs (what's been fixed) by version
Credits

Real-time search, reports, and dashboards

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Real-time search, reports, and dashboards

This feature allows users to select from a new time range option called "Real-time" which enables searching forward in time (as opposed to historical searches). Users can then view, search and report on events before Splunk's indexing process therebye making data available immediately.

Users can apply traditional boolean search operators or any aspect of the search language (such as statistical reporting commands) to create customized real-time search 'streams' that push incoming data to the user. Additionally real-time streams support the ability to update transaction counts or calculate metrics in real-time on large incoming data flows. Users can then combine multiple real-time searches and reports on a dashboard that can be shared with others.

This new feature can be accessed from the command-line or Splunk Web.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1.4/ReleaseNotes/Real-timesearchandreporting"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!