Documentation > Splunk > User Manual > Real-time reporting

User Manual

 


Welcome
Splunk Overview
Splunk Tutorial!
Index New Data
Search and Investigate
Capture Knowledge
Automate Monitoring
Analyze and Report
Search Examples and Walkthroughs

Real-time reporting

Real-time reporting

You can use Splunk's real-time search to calculate metrics in real-time on large incoming data flows without the use of summary indexing. However, because you are reporting on a live and continuous stream of data, the timeline will update as the events stream in and you can only view the table or chart in preview mode. Also, some search commands will be more applicable (for example, streamstats and rtorder) for use in real-time.

For a primer of reporting commands, see "Use reporting commands" in this manual.

Real-time reporting is accessible through Splunk Web and the CLI. For more information, read "About CLI searches" in the Search reference manual.

This feature is discussed in more detail and with examples in the User manual's "Search and Investigate" chapter. Refer to the topic "Real-time search and reporting".

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.2/User/RealtimeReporting"

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!