Security

How to find out a search is running as indexed realtime?

hsesterhenn
Path Finder

Hi,

with Splunk Enterprise V6 there is a new search mode called "indexed realtime".
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Aboutrealtimesearches

You can set this option globally in limits.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Limitsconf
or manually for every search in savedsearches.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/savedsearchesconf

This is useful e.g. for the Splunk App for Enterprise Security V3 where there are a lot of realtime searches running.

But how to find out a single search is run as indexed realtime?

There is no message in the splunkd.log or the _internal index!

BR

1 Solution

hsesterhenn
Path Finder

Answer to myself...

Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".

Then search for "IndexedRealtimeSearch"...

Hope that helps.

BR

View solution in original post

0 Karma

Nicolo_Figiani
Path Finder

Hello,
I was having the same question and I didn't find anything useful in search.log file.
However, there's a mention of all this in the _introspection index. If you run the following search:

index=_introspection "data.search_props.label"="the name of your search here"

take a look at the data.search_props.mode field. If the indexed RT is enabled, its value should be equal to: RT indexed.

The above worked for me, hope it helps...

Cheers,
n

hsesterhenn
Path Finder

Answer to myself...

Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".

Then search for "IndexedRealtimeSearch"...

Hope that helps.

BR

0 Karma

jrodman
Splunk Employee
Splunk Employee
"indexedRealtime": null

This is it? "null" is a bit unfortunate.

0 Karma

hsesterhenn
Path Finder

Thanks @mborner

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...