Is this a scheduled real-time search?

[a212830]

Hi,

Are processes that contain "rt_scheduler" real-time scheduled searches?

Example:

splunk 15005 75443 0 10:20 ? 00:00:00 [splunkd pid=75442] search --id=remote_azone567_rt_scheduler_Z527062gns_BillPay_at_1459002000_14090 --maxbuckets=0 --ttl=60 --maxout=0 --maxtime=0 --lookups=1 --streaming --outCsv=true --user=username_removed_for_answers_post --pro --roles=dbx_user:power:user

[martin_mueller]

Should be. To be certain, search index=_audit for that search ID and look for the oldest event, it should contain lots of info about the search.

[sloshburch]

I wonder if you can also check the search activity or jobs list to see the corresponding search and view what actually was run.

[martin_mueller]

Yeah, but that's only visible for as long as the job artefacts exist.