topic Realtime search with offset in Splunk Search

Realtime search with offset

Stefan_van_de_R — Wed, 04 Jul 2012 13:33:33 GMT

Hi,

Does anyone know if it is possible to do a realtime search with an offset?
The data that comes in has a delay of 5 minutes.
I tried in savedsearched.conf to set te latest_time at rt-5m but this doens't work.
Is it supported or should I search on another way?

-- Stefan

Re: Realtime search with offset

rturk — Wed, 04 Jul 2012 13:49:26 GMT

Hi Stefan,

Unfortunately as Splunk is essentially a passive reporting tool it can only report on events when it knows about them.

Having a rolling 5 minute RT window when data is dumped in at 5 minute intervals means you're going to miss events in the window you've specified.

If there is a requirement to report on this data in "real-time", then it might be worth looking at your data collection method and seeing whether the frequency of updates can be ramped up or whether the device/application you're collecting data from can output events so the Universal Forwarder can collect them and forward them as they are created (either by tailing a log or as a network stream).

I hope this has helped in some way!

Re: Realtime search with offset

Stefan_van_de_R — Tue, 17 Jul 2012 11:13:45 GMT

Thanks for your answer. For the moment, I accept the situation for what is. I didn't came up yet with tailing the log but that isn't a bad idea at all and will consider implementing it when I'm done with the Must-have requirements 🙂