Real time Alert

New Member


I'm trying to generate an alert if the result is greater than 2, but i don't have the field Real-Time as shown in the picture:
alt text

Is there any other way to generate this alert ?

Thank you

0 Karma

Esteemed Legend

There are very, Very, VERY good reasons that your admin has wisely taken away Real-Time, including:

1: Any real-time anything locks 1 core on EVERY Indexer and Your Search-Head. This does not scale.
2: You don't need it. If you cannot react to the alert in ~1s, a short-window regular search is just as effective.
3: There is pipeline latency in getting events into Splunk and a real-time search may search for your event before it has even arrived on the indexer and make for many false-negatives.

Despite what all of the marketing and training says, SPLUNK IS *NOT* A REAL-TIME PRODUCT!


Hi @omarka,

You need schedule_rtsearch permission to schedule a real time search.
Real-time alerts can be costly in terms of computing resources, so consider using a scheduled alert when possible. You could use schedule search to run every 1 minute which should be enough in most of the uses Define scheduled alerts. Also have a look at the Best Practices.

Happy Splunking!
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>