How can I identify real time searches?

[ddrillic]

We suspect that some of our users run real time searches. How can I produce a report which shows real time search activity in the past week, month or so?

[cmerriman]

use |rest /services/search/jobs|search isRealTimeSearch=1 to see if that gets you what you need.
http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTsearch#GET_search.2Fjobs documentation to know what fields you might want

[splunkreal]

|rest /services/search/jobs|search isRealTimeSearch=1 

works however it doesn't seem to work on expired jobs.

[Dallastek1]

try this:

index=_audit action=search is_realtime=1
| eval search_type=case(
search_id LIKE "scheduler%", "Scheduled Search",
search_id LIKE "rt_scheduler%", "Real-Time Scheduled Search",
search_id LIKE "dashboard%", "Dashboard",
search_id LIKE "adhoc%", "Ad-hoc Search",
1=1, "Ad-hoc Search"
)
| eval human_readable_time = strftime(_time, "%Y-%m-%d %H:%M:%S")
| stats count by user, search_type, _time
| rename human_readable_time AS "Time", user AS "User", search_type AS "Search Type", count AS "Search Count"
| sort - "Time"

[nickhills]

I have this running as an alert to let me know who is running rt searches, and how long for

| rest /services/search/jobs | search eventSorting=realtime | table label, author, dispatchState,  eai:acl.owner, label, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, searchProviders, splunk_server, title

[adobrzeniecki]

According to the documentation below, there is not an option for eventSorting=realtime.
Indicates if the events of this search are sorted, and in which order.
asc = ascending;

desc = descending;

none = not sorted

Would the actual setting to be used be isRealTimeSearch?

[mayurr98 · Accepted solution]

hey @ddrillic

try this

| rest /services/search/jobs | search eventSorting=realtime

I hope that helps you!

[pnodine1]

You can get cleaner results by adding a table.

|rest /services/search/jobs 
| search eventSorting=realtime 
| table label, author, dispatchState,  eai:acl.owner, label, isRealTimeSearch, 
  performance.dispatch.stream.local.duration_secs, runDuration, 
  splunk_server, title