Dashboards & Visualizations

Real-time search... on a summary index?

Jason
Motivator

What is the behavior if you set up a dashboard that creates a graph using a realtime search, but is using a summary index, say populated every 15 sec? Would this work as I expect it to (events would appear on the graph as they were added to the summary index by the scheduled search) ?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

There's no reason that you can't run a real time search on data going into a summary index. That said, since the scheduler runs no more frequently than every minute, you'll see >15s latency.

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

There's no reason that you can't run a real time search on data going into a summary index. That said, since the scheduler runs no more frequently than every minute, you'll see >15s latency.

0 Karma

Jason
Motivator

Ah, yes I had overlooked that even cron notation * * * * * would be run only every minute. Thanks!

0 Karma

Jason
Motivator

Haven't tried it yet, was wondering if someone had an answer.

0 Karma

araitz
Splunk Employee
Splunk Employee

What happens when you try it?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...