Do you know the difference between a search that is "done" and one that is "finalized"?  Do you know where to look? Is there any way to make this distinction more obvious in real time?  Learn how Splunxter has escalated the observability of this all-too-frequent sad reality and how you can, too.  As a bonus, we will be building a Modular Alert on the fly using this blog: https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-create-a-modular-alert.html