Splunk Search

Realtime search with offset

Stefan_van_de_R
Explorer

Hi,

Does anyone know if it is possible to do a realtime search with an offset?
The data that comes in has a delay of 5 minutes.
I tried in savedsearched.conf to set te latest_time at rt-5m but this doens't work.
Is it supported or should I search on another way?

-- Stefan

0 Karma

rturk
Builder

Hi Stefan,

Unfortunately as Splunk is essentially a passive reporting tool it can only report on events when it knows about them.

Having a rolling 5 minute RT window when data is dumped in at 5 minute intervals means you're going to miss events in the window you've specified.

If there is a requirement to report on this data in "real-time", then it might be worth looking at your data collection method and seeing whether the frequency of updates can be ramped up or whether the device/application you're collecting data from can output events so the Universal Forwarder can collect them and forward them as they are created (either by tailing a log or as a network stream).

I hope this has helped in some way!

Stefan_van_de_R
Explorer

Thanks for your answer. For the moment, I accept the situation for what is. I didn't came up yet with tailing the log but that isn't a bad idea at all and will consider implementing it when I'm done with the Must-have requirements 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...