Hey Browser, You’ve Got Tail!

For those interested in monitoring real-time data being consumed by Splunk we’ve introduced a new feature called Live Tail to the latest preview release. Additionally, we’ve added a nifty new REST endpoint /v3/splunk/tail for your custom application needs.

Live Tail

More information can be found in these videos:

  • A quick walkthrough of the new preview release feature Live Tail, its UI, and some sample code - See Video
  • An overview of the architecture used to integrate real-time data from Splunk Live Tail in a web browser. Challenges and workarounds when using JavaScript/Flash hybrids - See Video

Happy Streams!

4 Responses to “Hey Browser, You’ve Got Tail!”

  1. RJ Auburn Says:

    Carl,

    In a distributed deployment where is the search filters applied? At the edge indexing nodes when data first hits splunk or at the UI server hosting the view?

    Thanks, RJ

  2. Michael Wilde Says:

    Siiiiiiiiiiiiiiicccccccccckkkkkkkkkkk!

  3. Michael Wilde Says:

    Question: Is what we are seeing “pre-index”? or do we have all the searching power (including segment level searching) in Live Tail?

  4. Stephen Sorkin Says:

    RJ,

    Live tail is single server only for the near future.

    Michael,

    What you are seeing is pre-index, however, you have the full searching power, including segment level searching and wildcards. It doesn’t fully support search/where at the moment, but it will by GA.

Leave a Reply