Splunk Search
Highlighted

real-time search question

Champion

Hi,

Do real-time searches read events before they enter the indexer?

Tags (1)
0 Karma
Highlighted

Re: real-time search question

Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches

With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in.

View solution in original post

Highlighted

Re: real-time search question

Champion

Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.

0 Karma