topic Re: Non-windowed realtime search in Splunk Search

Non-windowed realtime search

mexa — Tue, 11 Mar 2014 01:57:33 GMT

On page 62 of the Splunk Search manual, it mentions that: "Windowed real-time searches are more expensive than non-windowed." And: "If your windowed search does not display the expected number of events, try a non-windowed search."

From what I understand, when you specify a time range in the Realtime search query, that makes it a "windowed" search. How do I run a non-windowed search in that case? I am simply interested in reading the newest events coming into the system, without doing any buffering on the server side. I am using the Java SDK for this.

Cheers

Re: Non-windowed realtime search

martin_mueller — Tue, 11 Mar 2014 13:43:19 GMT

You'll get a non-windowed realtime search by setting earliest_time=rt and latest_time=rt.

Re: Non-windowed realtime search

mexa — Wed, 12 Mar 2014 01:21:01 GMT

Thanks Martin. Do you know if there is a rate limit for the number of events forwarded to a realtime query?

Re: Non-windowed realtime search

martin_mueller — Mon, 28 Sep 2020 16:06:18 GMT

There is a realtime_buffer of 10000 defined in http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/limitsconf - I'm not sure if that's relevant for you though because that setting mentions splunkweb. There's also a queue_size of 10000, maybe more.