Splunk Search

restrict scheduled real-time searches?

a212830
Champion

Hi,

Is it possible to give people the ability to execute, but not schedule real-time searches?

1 Solution

jtrucks
Splunk Employee
Splunk Employee

Yes! In the Access Controls -> Roles -> Capabilities box, there is both rtsearch and schedule_rtsearch permissions. Give a role rtsearch and not schedule_rtsearch to do this.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Yes! In the Access Controls -> Roles -> Capabilities box, there is both rtsearch and schedule_rtsearch permissions. Give a role rtsearch and not schedule_rtsearch to do this.

--
Jesse Trucks
Minister of Magic

jtrucks
Splunk Employee
Splunk Employee

That 5 minute window is sliding. It is constantly moving as the search is updated every second or so. Read http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutrealtimesearches#Real-time_search_mechan... for exactly how it works.

--
Jesse Trucks
Minister of Magic
0 Karma

a212830
Champion

OK, but where does that 5 minute window come from, is someone puts "rt" for the start and end times for a schedule search?

0 Karma

jtrucks
Splunk Employee
Splunk Employee

It gives you all the results in a sliding window. If you have an active dashboard or if you are waiting for an event to trigger for testing something, a RT search with a 5 minute window might be quite useful. Also, scheduling a RT search means you get instant alert triggers for any conditions that should be met. This means within seconds of the matching criteria being written to the indexes, an alert is fired. Most people don't need anything better than a scheduled search running every five minutes or even every minute that looks back that five minutes or single minute, though.

--
Jesse Trucks
Minister of Magic
0 Karma

a212830
Champion

So, here's part II: why would anyone need to do a real-time search? I noticed searches that have a start time and an end time of "rt". What does that bring back? Seems like it would never end...

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Don't forget to mark it as answered 🙂

Glad I could help!

--
Jesse Trucks
Minister of Magic
0 Karma

a212830
Champion

AWESOME! Oh, lordy, lordy, lordy, that makes my day.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...