Hi,
with Splunk Enterprise V6 there is a new search mode called "indexed realtime".
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Aboutrealtimesearches
You can set this option globally in limits.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Limitsconf
or manually for every search in savedsearches.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/savedsearchesconf
This is useful e.g. for the Splunk App for Enterprise Security V3 where there are a lot of realtime searches running.
But how to find out a single search is run as indexed realtime?
There is no message in the splunkd.log or the _internal index!
BR
Answer to myself...
Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".
Then search for "IndexedRealtimeSearch"...
Hope that helps.
BR
Hello,
I was having the same question and I didn't find anything useful in search.log
file.
However, there's a mention of all this in the _introspection
index. If you run the following search:
index=_introspection "data.search_props.label"="the name of your search here"
take a look at the data.search_props.mode
field. If the indexed RT is enabled, its value should be equal to: RT indexed
.
The above worked for me, hope it helps...
Cheers,
n
Answer to myself...
Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".
Then search for "IndexedRealtimeSearch"...
Hope that helps.
BR
"indexedRealtime": null
This is it? "null" is a bit unfortunate.
Thanks @mborner