Splunk "real-time" using system resources ?

[SS1]

Hello SPlunkers,

'real-time' alerts are using up the maximum resources and resulting in skipped searches. does using a cron schedule which runs every 1 minute and the time range of last 61 seconds also cause stress to the system. What would be the ideal time range to use ?

[scelikok]

Every search effects system performance but while it is running. But changing from realtime to scheduled will help for sure.

Each realtime search keeps one CPU core all the time, that is why may causes skipped searches if search concurrency is high. When you change search to scheduled, it will release resources after search finalize. Splunk will be able to use those resource for other searches or processes. 

If you do not need to get that alert immediately, higher is better. It is better to think your response time to alert, if you cannot act immediately there maybe no need to run search realtime or every minute.

[scelikok]

Hi @SS1,

If your search does not take more than a minute, scheduled mode will help you a lot. You can use below crontab to run every minute;

* * * * *

[SS1]

My question is will it affect the perfomance of the splunk system if the cron runs every min?