Realtime search with offset

[Stefan_van_de_R]

Hi,

Does anyone know if it is possible to do a realtime search with an offset?
The data that comes in has a delay of 5 minutes.
I tried in savedsearched.conf to set te latest_time at rt-5m but this doens't work.
Is it supported or should I search on another way?

-- Stefan

[rturk]

Hi Stefan,

Unfortunately as Splunk is essentially a passive reporting tool it can only report on events when it knows about them.

Having a rolling 5 minute RT window when data is dumped in at 5 minute intervals means you're going to miss events in the window you've specified.

If there is a requirement to report on this data in "real-time", then it might be worth looking at your data collection method and seeing whether the frequency of updates can be ramped up or whether the device/application you're collecting data from can output events so the Universal Forwarder can collect them and forward them as they are created (either by tailing a log or as a network stream).

I hope this has helped in some way!

[Stefan_van_de_R]

Thanks for your answer. For the moment, I accept the situation for what is. I didn't came up yet with tailing the log but that isn't a bad idea at all and will consider implementing it when I'm done with the Must-have requirements 🙂