Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Real Time Searches
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any disadvantages if we are running real time searches and alerting using those, currently we are testing few functionalities in Dev/PreProd - but want to pick brain of exp community members if they can point to performance degradation issues if you run real time searches say Every Minute of less - and alert on them, or is better to increase time duration or Schedule searches...please advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Nikhil,
Real-Time searches does require CPU most of the time. But unless necessary you can just schedule them to run every 1 min/2 mins. The real-time alerts definitely works and depends on your server configuration how much it can dedicate for alerts ,dedicated searches for user, scheduled searches. You can take a look in limits.conf for the CPU and search calculations.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Nikhil,
Real-Time searches does require CPU most of the time. But unless necessary you can just schedule them to run every 1 min/2 mins. The real-time alerts definitely works and depends on your server configuration how much it can dedicate for alerts ,dedicated searches for user, scheduled searches. You can take a look in limits.conf for the CPU and search calculations.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks...so i am assuming advisable will be to schedule searches every 5-15 minutes etc (depend on your need as against doing same using Real time searches)
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
