typeahead
typeahead
Synopsis
Returns typeahead on a specified prefix.
Syntax
typeahead prefix=<string> count=<int> [max_time=<int>] [<index-specifier>] [<starttimeu>] [<endtimeu>] [collapse]
Required arguments
- prefix
- Syntax: prefix=<string>
- Description: The full search string to return typeahead information.
- count
- Syntax: count=<int>
- Description: The maximum number of results to return.
Optional arguments
- index-specifier
- Syntax: index=<string>
- Description: Search the specified index instead of the default index.
- max_time
- Syntax: max_time=<int>
- Description: The maximum time in seconds that typeahead can run. If max_time=0, there is no limit.
- startimeu
- Syntax: starttimeu=<int>
- Description: Set the start time to N seconds since the epoch (Unix time). Defaults to 0.
- endtimeu
- Syntax: endtimeu=<int>
- Description: Set the end time to N seconds since the epoch (Unix time). Defaults to now.
- collapse
- Syntax: collapse=<bool>
- Description: Specify whether to collapse terms that are a prefix of another term and the event count is the same. Defaults to true.
Description
Returns typeahead on a specified prefix. Only returns a max of count results, can be targeted to an index and restricted by time.
Examples
Example 1: Return typeahead information for sources in the "_internal" index.
| typeahead prefix=source count=10 index=_internalAnswers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the typeahead command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.