Developing for Splunk Enterprise

Is running a real time search using the sdk supposed to return duplicate results?


If so, is there a proper way to get around that? Possibly get data as they come in?

For Instance:

If I run a real-time-search for a minute on the Splunk server(localhost) while running the same search using the SDK, I seem to get 30 results in the server while there is almost an infinite number of results being printed in the SDK.

I do not know if it might help my case, but I am using the eventgen app to regulate event generation.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.