Does anyone know if it is possible to do a realtime search with an offset? The data that comes in has a delay of 5 minutes. I tried in savedsearched.conf to set te latest_time at rt-5m but this doens't work. Is it supported or should I search on another way?
asked 04 Jul '12, 06:33
Stefan van d...
Unfortunately as Splunk is essentially a passive reporting tool it can only report on events when it knows about them.
Having a rolling 5 minute RT window when data is dumped in at 5 minute intervals means you're going to miss events in the window you've specified.
If there is a requirement to report on this data in "real-time", then it might be worth looking at your data collection method and seeing whether the frequency of updates can be ramped up or whether the device/application you're collecting data from can output events so the Universal Forwarder can collect them and forward them as they are created (either by tailing a log or as a network stream).
I hope this has helped in some way!
answered 04 Jul '12, 06:49