Splunk Search

why events show up in 5 min. window but not in 30-sec for real-time search?

sou128
Explorer

hi,

pretty new to splunk. I'm setting up a realtime search that will refresh every 30 sec. Here's my query on the search form.

source="C:\tmp\log4j2.log" bam userlogin
and I selected 30-second window from the dropdown

I've a simple simulator class that writes a single msg to the log file every 3 seconds with a total of 20 msg's. The msg's don't show up as the timeline advances, but usually only the last msg shows up. But if I set the refresh window to a higher number like 5 min., all the msg's show up.

Can anyone explain why this is? thanks

Tags (2)
0 Karma

woodcock
Esteemed Legend

I can think of 2 reasons:
1: Every input pipeline has a latency (delay in delivery/processing until it is available for search). It my take more than 30 seconds for the app to gather the event, dump the logs to a file, Splunk forwarder to process them, Splunk indexer to to process them.
2: If you are processing a "durationful" event and are using the "start time", you will see this kind of problem. You should always use "end time" when you have a "duratoinful" event. If you use "start time" than events will appear "too far back" for your window to ever see them.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...