real-time search/alerting

a212830 · ‎05-19-2013

Hi,

One of my customers enabled a real-time search and alerting that has started sending out thousands of messages. Some of these alerts are based upon data that is over a year old. The logs that provide this data were recently added, but I don't understand why old data would get triggered from a real-time search.

Ayn · ‎05-19-2013

Because realtime searches search over all incoming data as it comes in in real time, regardless of the events' timestamps.

a212830 · ‎05-19-2013

Thanks. Is there a way to have a "continuous" search running that only looks at recent events?

real-time search/alerting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

real-time search/alerting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience