https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180371#M51944 <P>It gives you all the results in a sliding window. If you have an active dashboard or if you are waiting for an event to trigger for testing something, a RT search with a 5 minute window might be quite useful. Also, scheduling a RT search means you get instant alert triggers for any conditions that should be met. This means within seconds of the matching criteria being written to the indexes, an alert is fired. Most people don't need anything better than a scheduled search running every five minutes or even every minute that looks back that five minutes or single minute, though.</P> Mon, 16 Dec 2013 20:40:30 GMT jtrucks 2013-12-16T20:40:30Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180366#M51939 <P>Hi,</P> <P>Is it possible to give people the ability to execute, but not schedule real-time searches?</P> Mon, 16 Dec 2013 20:08:42 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180366#M51939 a212830 2013-12-16T20:08:42Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180367#M51940 <P>Yes! In the Access Controls -&gt; Roles -&gt; Capabilities box, there is both <CODE>rtsearch</CODE> and <CODE>schedule_rtsearch</CODE> permissions. Give a role <CODE>rtsearch</CODE> and not <CODE>schedule_rtsearch</CODE> to do this.</P> Mon, 16 Dec 2013 20:11:45 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180367#M51940 jtrucks 2013-12-16T20:11:45Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180368#M51941 <P>AWESOME! Oh, lordy, lordy, lordy, that makes my day.</P> Mon, 16 Dec 2013 20:27:47 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180368#M51941 a212830 2013-12-16T20:27:47Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180369#M51942 <P>Don't forget to mark it as answered <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Glad I could help!</P> Mon, 16 Dec 2013 20:31:37 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180369#M51942 jtrucks 2013-12-16T20:31:37Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180370#M51943 <P>So, here's part II: why would anyone need to do a real-time search? I noticed searches that have a start time and an end time of "rt". What does that bring back? Seems like it would never end...</P> Mon, 16 Dec 2013 20:35:14 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180370#M51943 a212830 2013-12-16T20:35:14Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180371#M51944 <P>It gives you all the results in a sliding window. If you have an active dashboard or if you are waiting for an event to trigger for testing something, a RT search with a 5 minute window might be quite useful. Also, scheduling a RT search means you get instant alert triggers for any conditions that should be met. This means within seconds of the matching criteria being written to the indexes, an alert is fired. Most people don't need anything better than a scheduled search running every five minutes or even every minute that looks back that five minutes or single minute, though.</P> Mon, 16 Dec 2013 20:40:30 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180371#M51944 jtrucks 2013-12-16T20:40:30Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180372#M51945 <P>OK, but where does that 5 minute window come from, is someone puts "rt" for the start and end times for a schedule search?</P> Mon, 16 Dec 2013 22:53:30 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180372#M51945 a212830 2013-12-16T22:53:30Z https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180373#M51946 <P>That 5 minute window is sliding. It is constantly moving as the search is updated every second or so. Read <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutrealtimesearches#Real-time_search_mechanics">http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutrealtimesearches#Real-time_search_mechanics</A> for exactly how it works.</P> Mon, 16 Dec 2013 22:58:04 GMT https://community.splunk.com/t5/Splunk-Search/restrict-scheduled-real-time-searches/m-p/180373#M51946 jtrucks 2013-12-16T22:58:04Z