topic Re: How can I identify real time searches? in Splunk Search

How can I identify real time searches?

ddrillic — Mon, 08 Jun 2020 18:07:00 GMT

We suspect that some of our users run real time searches. How can I produce a report which shows real time search activity in the past week, month or so?

Re: How can I identify real time searches?

mayurr98 — Tue, 09 Jan 2018 16:33:16 GMT

hey @ddrillic

try this

| rest /services/search/jobs | search eventSorting=realtime

I hope that helps you!

Re: How can I identify real time searches?

nickhills — Tue, 09 Jan 2018 16:38:29 GMT

I have this running as an alert to let me know who is running rt searches, and how long for

| rest /services/search/jobs | search eventSorting=realtime | table label, author, dispatchState,  eai:acl.owner, label, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, searchProviders, splunk_server, title

Re: How can I identify real time searches?

cmerriman — Tue, 09 Jan 2018 16:38:37 GMT

use |rest /services/search/jobs|search isRealTimeSearch=1 to see if that gets you what you need.
http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTsearch#GET_search.2Fjobs documentation to know what fields you might want

Re: How can I identify real time searches?

adobrzeniecki — Tue, 02 Jun 2020 12:53:16 GMT

According to the documentation below, there is not an option for eventSorting=realtime.
Indicates if the events of this search are sorted, and in which order.
asc = ascending;

desc = descending;

none = not sorted

Would the actual setting to be used be isRealTimeSearch?

Re: How can I identify real time searches?

splunkreal — Thu, 30 Jul 2020 16:49:57 GMT

|rest /services/search/jobs|search isRealTimeSearch=1

works however it doesn't seem to work on expired jobs.

Re: How can I identify real time searches?

pnodine1 — Wed, 27 Mar 2024 15:26:01 GMT

You can get cleaner results by adding a table.

|rest /services/search/jobs | search eventSorting=realtime | table label, author, dispatchState, eai:acl.owner, label, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, splunk_server, title

Re: How can I identify real time searches?

Dallastek1 — Thu, 07 Nov 2024 18:31:17 GMT

try this:

index=_audit action=search is_realtime=1 | eval search_type=case( search_id LIKE "scheduler%", "Scheduled Search", search_id LIKE "rt_scheduler%", "Real-Time Scheduled Search", search_id LIKE "dashboard%", "Dashboard", search_id LIKE "adhoc%", "Ad-hoc Search", 1=1, "Ad-hoc Search" ) | eval human_readable_time = strftime(_time, "%Y-%m-%d %H:%M:%S") | stats count by user, search_type, _time | rename human_readable_time AS "Time", user AS "User", search_type AS "Search Type", count AS "Search Count" | sort - "Time"