Developing for Splunk Enterprise

Is running a real time search using the sdk supposed to return duplicate results?


If so, is there a proper way to get around that? Possibly get data as they come in?

For Instance:

If I run a real-time-search for a minute on the Splunk server(localhost) while running the same search using the SDK, I seem to get 30 results in the server while there is almost an infinite number of results being printed in the SDK.

I do not know if it might help my case, but I am using the eventgen app to regulate event generation.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!