Security

How to find out a search is running as indexed realtime?

Path Finder

Hi,

with Splunk Enterprise V6 there is a new search mode called "indexed realtime".
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Aboutrealtimesearches

You can set this option globally in limits.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Limitsconf
or manually for every search in savedsearches.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/savedsearchesconf

This is useful e.g. for the Splunk App for Enterprise Security V3 where there are a lot of realtime searches running.

But how to find out a single search is run as indexed realtime?

There is no message in the splunkd.log or the _internal index!

BR

1 Solution

Path Finder

Answer to myself...

Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".

Then search for "IndexedRealtimeSearch"...

Hope that helps.

BR

View solution in original post

0 Karma

Path Finder

Hello,
I was having the same question and I didn't find anything useful in search.log file.
However, there's a mention of all this in the _introspection index. If you run the following search:

index=_introspection "data.search_props.label"="the name of your search here"

take a look at the data.search_props.mode field. If the indexed RT is enabled, its value should be equal to: RT indexed.

The above worked for me, hope it helps...

Cheers,
n

Path Finder

Answer to myself...

Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".

Then search for "IndexedRealtimeSearch"...

Hope that helps.

BR

View solution in original post

0 Karma

Splunk Employee
Splunk Employee
"indexedRealtime": null

This is it? "null" is a bit unfortunate.

0 Karma

Path Finder

Thanks @mborner

0 Karma