Product News & Announcements
All the latest news and announcements about Splunk products. Subscribe and never miss an update!

Welcome to the Future of Data Search & Exploration

bjanczer_splunk
Splunk Employee
Splunk Employee

You have more data coming at you than ever before. Over the next five years, the total amount of digital data is going to be more than twice the amount of data created since the advent of digital storage.

With the success of your company often determined by how you anticipate and respond to threats – and leverage meaningful insights – you need the ability to quickly search and find insights in your data, despite this increasing deluge of information.

Simultaneously, you need to empower more users than ever before to access and find insights in their data, regardless of their skill level or technical acumen.

And despite more data, more users, and faster queries, you need tools that are ever more cost-efficient, to meet IT budgets that seldom scale to data storage and demand. 

Introducing a Revolutionized Search Experience

 

Splunk is uniquely positioned to ride this data wave, with users performing billions of monthly ad-hoc queries against data of all structures and sizes. 

Working with numerous customers and drawing upon 20+ years of historical feedback, Splunk is pleased to announce the Public Preview of a complete redesign of its core Search experience, accelerating the data-to-insight workflow, and bringing the power of Splunk to everyone.

Faster Time-to-Insight for Advanced Investigations

Robust IDE-Style Code Editor

spl2-search-code-editor.gif

With the new Search experience, you’re no longer confined to a small search box to write your queries. With a resizable IDE-style editor, you have all the space you need to write complex searches. 

Updated and More Powerful Search Language (SPL2)

bjanczer_splunk_4-1659359109788.gif

The new editor supports our updated Search Processor Language (SPL2), a more concise and powerful version of our search language. SPL2 is designed for users with a range of query language backgrounds including SPL and SQL while maintaining a similar syntax for familiarity. It also introduces a range of powerful capabilities such as built-in functions, types, and the ability to add comments.

If you’ve never written SPL searches before – or occasionally forget which command to use or the correct syntax – auto-completion and in-line documentation make it fast and easy to start writing searches.

Multi-Statement Search

bjanczer_splunk_5-1659359109814.gif

Thanks to the power of SPL2, you can now perform multiple searches all within a single Search Module. It’s extremely common for individuals to want to iteratively build searches or even branch investigations. For instance, after preparing a view of their data, they may wish to conduct a certain set of analysis with one set of queries and conduct separate analysis on the same data with a different set of queries. This previously resulted in a proliferation of browser tabs. However, with the new search experience, a user can take the output of one search and use it as a starting point for another search, all within the same experience!

Reusable Searches

bjanczer_splunk_6-1659359109643.gif

Every search query you write can be exported as a reusable dataset, making it easy to share specific views of your data.

Integrated Charting

 

spl2-search-charting.gif

The new Search experience also supports multiple charts. Instead of having to delete and re-write different commands to see various visualizations of your data, it’s easy to point-and-click and create as many charts as you’d like from the same base search.

The Power of Splunk for Everyone

Point-and-Click Search Creation

bjanczer_splunk_3-1659359049018.gif

The ability to search through structured and completely unstructured data is now available to everyone! Users can create complex queries on the fly using easy point-and-click interactivity. Everything from creating filters, to adding fields to display, to building charts, can be done directly through the interface, without ever needing to write SPL2.

Bi-Directional Editing

bjanczer_splunk_2-1659359004890.gif

While Splunk has offered point-and-click tools in the past, such as our extremely popular Table Views, this new Search experience is completely bi-directional. A first-time user can generate a query using point-and-click actions, while an advanced user can edit that query using the code editor. Both users can seamlessly collaborate on the same query.

Save and Share

bjanczer_splunk_1-1659358990590.gif

Once a user has finished searching their data, their entire multi-search statement investigation, including charts, can be saved as a Search Module for easy reuse and collaboration. Search Modules can be saved to a user's private workspace, or saved to a shared workspace where they can collaborate with others.

Get Started Today!

 

In the words of Aaron Dobbins, President of Ellenby Technologies, “The new Search experience for Splunk Cloud helps us to iterate through questions we have hidden in our data more efficiently than ever before, all without needing deep knowledge of the SPL language.”

Splunk’s new Search experience is now available as a public preview, at no extra cost, to Splunk Cloud customers in AWS US and EU-West (Dublin) based data centers (with more regions to follow). Register your interest here!

— Author: Jacob Stark (Director, Product Management)

youngsuh
Contributor

when would this be available for on-prem?

andreasz
Path Finder

I have the same question as @youngsuh.
I really hope you don't forget the on-prem customers.

boss6
Loves-to-Learn

Looks fantastic.  Curious - is this something that gets enabled in my cloud stack, or do I need to login to a separate Splunk managed environment, which is then given access to my data?

 

 

bjanczer_splunk
Splunk Employee
Splunk Employee

@youngsuh Great question! From a long-term strategy perspective, the ultimate goal is for this experience to be also available on-prem.  We know that there is still a lot of functionality and underlying dependencies that need to be developed over time to achieve that goal.

bjanczer_splunk
Splunk Employee
Splunk Employee

@boss6 Thank you so much for the feedback! We love that you love it! You can register to get access here! We currently support AWS US-West, US-East, and EU-West (Dublin) based data centers (with more regions to follow).

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...