Dashboards & Visualizations
Highlighted

Real-time search... on a summary index?

Motivator

What is the behavior if you set up a dashboard that creates a graph using a realtime search, but is using a summary index, say populated every 15 sec? Would this work as I expect it to (events would appear on the graph as they were added to the summary index by the scheduled search) ?

Highlighted

Re: Real-time search... on a summary index?

Splunk Employee
Splunk Employee

What happens when you try it?

0 Karma
Highlighted

Re: Real-time search... on a summary index?

Motivator

Haven't tried it yet, was wondering if someone had an answer.

0 Karma
Highlighted

Re: Real-time search... on a summary index?

Splunk Employee
Splunk Employee

There's no reason that you can't run a real time search on data going into a summary index. That said, since the scheduler runs no more frequently than every minute, you'll see >15s latency.

View solution in original post

0 Karma
Highlighted

Re: Real-time search... on a summary index?

Motivator

Ah, yes I had overlooked that even cron notation * * * * * would be run only every minute. Thanks!

0 Karma