how to send newly added events in the data source to the client

[uknwhu]

hi, im new to splunk. I've been playing around with splunk-javascript api for few days. My purpose of using splunk is as a log management system, Where i want it to send any newly added events in the data-source to the client in real-time. I don't want to perform any search operation and return filtered data, but all the data in the data-source. I was able to use search 'all' and retrieve data from splunk. but i couldn't configure the splunk to send newly added log-data to the client as and when it is occurred. Can anyone help me?

[Ayn · Accepted solution]

It depends a bit on what you mean by "client". You can do real-time searches in Splunk - that is, you issue a search and specify the time range to be "real-time", and Splunk will send back results to you as they come in.

I don't know if this qualifies for your scenario or if it's a requirement that Splunk will send these events to you somehow without you having to issue a search at all. If you simply want to forward events automatically like that instead, you can setup some kind of process that Splunk can send data as raw TCP to. Have a look at the docs concerning this here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarddatatothird-partysystemsd

[uknwhu]

This helped. Thanks.

[uknwhu]

is it possible to listen to real-time updates in server from splunk sdk?