topic Re: How can I index data in real time? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345649#M63498 <P>Hi @chintan_shah,</P> <P>Are you getting any error in Splunk Universal Forwarder's splunkd.log ?</P> <P>Thanks,<BR /> Harshil</P> Wed, 27 Sep 2017 15:30:57 GMT harsmarvania57 2017-09-27T15:30:57Z How can I index data in real time? https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345648#M63497 <P>I have created an alert which checks if logs are not present in last 20 mins per source. I have around 32 source files from single forwarder. Many of my files are not getting indexed in real time and I am receiving this alert frequently.</P> <P>Can anyone tell me any parameters which needs to be changed so that I can index the data in real time?<BR /> is there any mechanism to check what is the inflow rate of the data?</P> <P>System Info:<BR /> I also see my CPU is around 80% idle and working Windows OS. I have 4 Core machine 32gb ram <BR /> Splunk Enterprise 6.4.3</P> Thu, 21 Sep 2017 18:11:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345648#M63497 chintan_shah 2017-09-21T18:11:07Z Re: How can I index data in real time? https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345649#M63498 <P>Hi @chintan_shah,</P> <P>Are you getting any error in Splunk Universal Forwarder's splunkd.log ?</P> <P>Thanks,<BR /> Harshil</P> Wed, 27 Sep 2017 15:30:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345649#M63498 harsmarvania57 2017-09-27T15:30:57Z Re: How can I index data in real time? https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345650#M63499 <P>@chintan_shah - First, please determine whether the files are not being indexed in a timely manner, or not being forwarded in a timely manner.</P> <P>Second, check through the debug steps at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata#Are_you_using_forwarders.">"I can't find my data"</A></P> Wed, 27 Sep 2017 19:31:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-index-data-in-real-time/m-p/345650#M63499 DalJeanis 2017-09-27T19:31:14Z