Splunk Search

Defining a Real time search window

Explorer

Hello,

I would like to set a real time search which counts events occurred starting from the beginning of the day (12am) until current time.

Using the convention of "earliest=-0d@d latest=rt" yielded an error.

Any ideas on how to define such window in real time search ?

Thanks.

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

Hi oreni

The 'rt' values are not designed to be used within the search language. They are configuration values that can be used inside times.conf (to add predefined options to the Time Range Picker), in the saved search dialog or if you were directly using the REST API to access the splunk backend search engine.

I just tested it and this entry in times.conf works fine in 4.1.8:

[rt-yesterday]
label = Real-Time Yesterday
earliest_time = rt-1d@d
latest_time = rt
order = 10

cheers

View solution in original post

SplunkTrust
SplunkTrust

Hi oreni

The 'rt' values are not designed to be used within the search language. They are configuration values that can be used inside times.conf (to add predefined options to the Time Range Picker), in the saved search dialog or if you were directly using the REST API to access the splunk backend search engine.

I just tested it and this entry in times.conf works fine in 4.1.8:

[rt-yesterday]
label = Real-Time Yesterday
earliest_time = rt-1d@d
latest_time = rt
order = 10

cheers

View solution in original post

SplunkTrust
SplunkTrust

Hi oreni

did you enable the Real-time backfill in limits.conf?

cheers

Explorer

Yes, I've set this flag to true and still there was no change.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!