Splunk Search

How to get a search in Splunk to show results from the last 24 hours and update in real-time every minute?

stefanlasiewski
Contributor

I know that Splunk can show me results for the last 24 hours. I also know that Splunk can show me results in real time, with times like a "1 minute window".

I would like to see Splunk search results from the 24 hours, and also update these results in real time. This way, I can log into Splunk, bring up my dashboard and get a sense of what happened in the last day and show me what is going on from here on out.

0 Karma

kml_uvce
Builder

use earliest time as rt-24h in your dashboard

0 Karma

stefanlasiewski
Contributor

This isn't showing me data from the previous 24 hours. This seems to show me data from now on forward, and refreshes every 24 hours. Or at least, that is what my test with Earliest: rt-30m Latest=rt or with a "30 minute window" does.

0 Karma

acharlieh
Influencer
0 Karma

stefanlasiewski
Contributor

That's what I've been trying, but it's not updating in real time.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...