Real time Alert

New Member


I'm trying to generate an alert if the result is greater than 2, but i don't have the field Real-Time as shown in the picture:
alt text

Is there any other way to generate this alert ?

Thank you

0 Karma

Esteemed Legend

There are very, Very, VERY good reasons that your admin has wisely taken away Real-Time, including:

1: Any real-time anything locks 1 core on EVERY Indexer and Your Search-Head. This does not scale.
2: You don't need it. If you cannot react to the alert in ~1s, a short-window regular search is just as effective.
3: There is pipeline latency in getting events into Splunk and a real-time search may search for your event before it has even arrived on the indexer and make for many false-negatives.

Despite what all of the marketing and training says, SPLUNK IS *NOT* A REAL-TIME PRODUCT!


Hi @omarka,

You need schedule_rtsearch permission to schedule a real time search.
Real-time alerts can be costly in terms of computing resources, so consider using a scheduled alert when possible. You could use schedule search to run every 1 minute which should be enough in most of the uses Define scheduled alerts. Also have a look at the Best Practices.

Happy Splunking!
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...