Splunk Search

What search commands are supported by real-time searches?

Jason
Motivator

What search commands are supported by real-time searches?

I can't find this information in the manual.

Tags (2)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

Quoting from the Search Manual topic, About real-time searches: "Real-time searches can take advantage of all Splunk search functionality, including advanced functionality like lookups, transactions, and so on. We've also designed search commands that are to be used specifically in conjunction with real-time searches, such as streamstats and rtorder."

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Thanks, Jason. I will have the writer for the Search Manual look into that and update the docs!

0 Karma

Jason
Motivator

Evidently that's not completely true, as you get an error "This command is not supported in a real-time search" when you try to run an | inputlookup in a real time search. Also, appends don't work, and don't give errors.

index=_internal | stats count by host | append [inputlookup allhosts] | stats max(count) as count by host works as expected on a non-RT search but doesn't show any values in the lookup that are not in the main seach when changed to RT.

0 Karma

Jason
Motivator

Bump. There must be a listing of these somewhere?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...