Splunk Search

How to save the system resources of realtime search?

laiyongmao
Path Finder

If I want to run for realtime search, but my machine does not support, how to save the resource of the system?

Tags (1)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

The closest you can get is to schedule a search every minute that looks at earliest=-1m@m latest=-0m@m to iterate over the previous minute. Worst case your results are about a minute lagged from the events.

--
Jesse Trucks
Minister of Magic

View solution in original post

0 Karma

jtrucks
Splunk Employee
Splunk Employee

The closest you can get is to schedule a search every minute that looks at earliest=-1m@m latest=-0m@m to iterate over the previous minute. Worst case your results are about a minute lagged from the events.

--
Jesse Trucks
Minister of Magic
0 Karma

laiyongmao
Path Finder

Thank you jtrucks ! because we require data accuracy and high safety, all I want to know Splunk high availability is how to achieve, what is the internal mechanism, how in the optimal conditions, the realization of these?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...