|
Hi, Does anyone know if it is possible to do a realtime search with an offset? The data that comes in has a delay of 5 minutes. I tried in savedsearched.conf to set te latest_time at rt-5m but this doens't work. Is it supported or should I search on another way? -- Stefan |
|
Hi Stefan, Unfortunately as Splunk is essentially a passive reporting tool it can only report on events when it knows about them. Having a rolling 5 minute RT window when data is dumped in at 5 minute intervals means you're going to miss events in the window you've specified. If there is a requirement to report on this data in "real-time", then it might be worth looking at your data collection method and seeing whether the frequency of updates can be ramped up or whether the device/application you're collecting data from can output events so the Universal Forwarder can collect them and forward them as they are created (either by tailing a log or as a network stream). I hope this has helped in some way! Thanks for your answer. For the moment, I accept the situation for what is. I didn't came up yet with tailing the log but that isn't a bad idea at all and will consider implementing it when I'm done with the Must-have requirements :-)
(17 Jul '12, 04:13)
Stefan van d...
|
