https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51135#M12306 <P>Thanks, Jason. I will have the writer for the Search Manual look into that and update the docs!</P> Fri, 27 Sep 2013 15:09:54 GMT ChrisG 2013-09-27T15:09:54Z https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51131#M12302 <P>What search commands are supported by real-time searches?</P> <P>I can't find this information in the manual.</P> Tue, 05 Mar 2013 10:15:15 GMT https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51131#M12302 Jason 2013-03-05T10:15:15Z https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51132#M12303 <P>Bump. There must be a listing of these somewhere?</P> Fri, 26 Apr 2013 10:56:36 GMT https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51132#M12303 Jason 2013-04-26T10:56:36Z https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51133#M12304 <P>Quoting from the Search Manual topic, <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Search/Aboutrealtimesearches">About real-time searches</A>: "Real-time searches can take advantage of all Splunk search functionality, including advanced functionality like lookups, transactions, and so on. We've also designed search commands that are to be used specifically in conjunction with real-time searches, such as streamstats and rtorder."</P> Fri, 26 Apr 2013 19:44:52 GMT https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51133#M12304 ChrisG 2013-04-26T19:44:52Z https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51134#M12305 <P>Evidently that's not completely true, as you get an error "This command is not supported in a real-time search" when you try to run an <CODE>| inputlookup</CODE> in a real time search. Also, appends don't work, and don't give errors.</P> <P><CODE>index=_internal | stats count by host | append [inputlookup allhosts] | stats max(count) as count by host</CODE> works as expected on a non-RT search but doesn't show any values in the lookup that are not in the main seach when changed to RT.</P> Fri, 27 Sep 2013 09:33:31 GMT https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51134#M12305 Jason 2013-09-27T09:33:31Z https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51135#M12306 <P>Thanks, Jason. I will have the writer for the Search Manual look into that and update the docs!</P> Fri, 27 Sep 2013 15:09:54 GMT https://community.splunk.com/t5/Splunk-Search/What-search-commands-are-supported-by-real-time-searches/m-p/51135#M12306 ChrisG 2013-09-27T15:09:54Z