topic Re: Defining a Real time search window in Splunk Search

Defining a Real time search window

oreni — Thu, 27 Oct 2011 14:01:09 GMT

Hello,

I would like to set a real time search which counts events occurred starting from the beginning of the day (12am) until current time.

Using the convention of "earliest=-0d@d latest=rt" yielded an error.

Any ideas on how to define such window in real time search ?

Thanks.

Re: Defining a Real time search window

MuS — Thu, 27 Oct 2011 14:18:14 GMT

Hi oreni

did you enable the Real-time backfill in limits.conf?

cheers

Re: Defining a Real time search window

oreni — Thu, 27 Oct 2011 14:22:54 GMT

Yes, I've set this flag to true and still there was no change.

Re: Defining a Real time search window

MuS — Fri, 28 Oct 2011 12:20:47 GMT

Hi oreni

The 'rt' values are not designed to be used within the search language. They are configuration values that can be used inside times.conf (to add predefined options to the Time Range Picker), in the saved search dialog or if you were directly using the REST API to access the splunk backend search engine.

I just tested it and this entry in times.conf works fine in 4.1.8:

[rt-yesterday]
label = Real-Time Yesterday
earliest_time = rt-1d@d
latest_time = rt
order = 10

cheers