Defining a Real time search window

[oreni]

Hello,

I would like to set a real time search which counts events occurred starting from the beginning of the day (12am) until current time.

Using the convention of "earliest=-0d@d latest=rt" yielded an error.

Any ideas on how to define such window in real time search ?

Thanks.

[MuS · Accepted solution]

Hi oreni

The 'rt' values are not designed to be used within the search language. They are configuration values that can be used inside times.conf (to add predefined options to the Time Range Picker), in the saved search dialog or if you were directly using the REST API to access the splunk backend search engine.

I just tested it and this entry in times.conf works fine in 4.1.8:

[rt-yesterday]
label = Real-Time Yesterday
earliest_time = rt-1d@d
latest_time = rt
order = 10

cheers

[MuS]

Hi oreni

did you enable the Real-time backfill in limits.conf?

cheers

[oreni]

Yes, I've set this flag to true and still there was no change.