Getting started

This guide is for users participating in the Splunk Early Adopter Program who are getting a sneak preview of Search Experience, which is part of a new user-interface (UI) for Splunk Cloud Platform.

From the Search Experience preview you can:

• Search data and create charts
• Use easy point-and-click actions for many common actions like filtering
• Create multiple, related searches in a single file
• Share searches and custom functions with other users or groups
• Use sample files to learn how to search event data using Splunk Search Processing Language, version 2 (SPL2)

Preview features are provided by Splunk to you "as is" without any warranties, maintenance and support, or service level commitments. Splunk makes this preview feature available in its sole discretion and may discontinue it at any time. Use of preview features is subject to the Splunk General Terms.

Setup for Admins

To make the indexes in your Splunk Cloud Platform deployment visible in the Search Experience preview, your Splunk Admin must:

1. Connecting your Splunk Cloud deployment to the Search Experience preview.
2. Grant users access to indexes in the Search Experience preview.

New terms and concepts

While exploring the Search Experience preview, you will encounter a few new terms and concepts, such as "module" and "workspace". See New terms and concepts.

My workspace page

The user-interface includes a set of pages and actions from which you can access your data, create searches and share content. The My workspace page is your personal work area. The My Workspace page is where you create and work with your search modules.

The My workspace page is the landing page for the Search Experience preview.

Sample content

From the My workspace page, you can install a set of sample content that includes a set of sample data and sample modules. You can use the sample data independently or with the sample modules. The sample modules are designed to help you learn SPL2. See:

• Sample data
• Sample modules

Shared workspaces page

Use the Shared workspaces page to create new workspaces that you share with other users or teams. Within the workspaces you create, you can create one or more search modules or pipelines. See:

• Shared workspaces
• Managing collaboration access

Datasets page

Use the Dataset page to see a list of the datasets that you have access to. You can select a dataset and use the Open in search icon to open the dataset in a new module in your My workspace area.

Search

The Search action opens a new untitled module in the Search Experience, where you can search data and create charts. You can either save the module either in you My workspace or in a shared workspace that you have access to.

You can create a new module or open an existing module in Search by using the My workspace page or Shared workspaces page.

Creating searches

Searches are created inside a search module. To get started, see Search Experience overview.

In the Search Experience preview, you can use either point-and-click actions to create and run searches, or you can search using the Search Processing Language, version 2 (SPL2).

• Search using point-and-click
• Search using SPL2

In addition, there are sample modules that you can install to help you learn SPL2. See Sample modules.

Creating charts

You create charts from the searches in your search modules, either in your My workspace or Shared workspaces areas. See Creating charts.

Send feedback

We'd appreciate hearing your thoughts about this new UI. In Search, select the Help icon and choose Send feedback for Search.

See also

Related information

What is SPL2?

Known issues