finalize

verb

An action you can perform on running searches. This stops the search before it completes and gets the results that Splunk has retrieved up to that point. You can use the finalized results to build a report.

For more information

In the User Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time