how do I tell how often real-time searches are run?

[cphair]

Hello. I'm considering disabling real-time searches for my app, but first I'd like to know whether they're being used at all. Is there a way to see what time ranges have been chosen for recent searches? searches.log only has the search string itself, and SoS doesn't seem to have a useful view for this.

[MuS · Accepted solution]

Hi cphair,

you can run this search

 index=_internal source="*metrics.log" group=realtime_search_data | timechart count by sid usenull=f useother=f

to get an overview if there are real-time searches run at all over the last 30 days (default retention for index _internal).
By the way, the user role does not have the rtsearch capabilities by default.

hope this helps ...

cheers, MuS

[cphair]

Cool. Thank you.