How to find out a search is running as indexed realtime?

[hsesterhenn]

Hi,

with Splunk Enterprise V6 there is a new search mode called "indexed realtime".
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Aboutrealtimesearches

You can set this option globally in limits.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Limitsconf
or manually for every search in savedsearches.conf
http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/savedsearchesconf

This is useful e.g. for the Splunk App for Enterprise Security V3 where there are a lot of realtime searches running.

But how to find out a single search is run as indexed realtime?

There is no message in the splunkd.log or the _internal index!

BR

[Nicolo_Figiani]

Hello,
I was having the same question and I didn't find anything useful in search.log file.
However, there's a mention of all this in the _introspection index. If you run the following search:

index=_introspection "data.search_props.label"="the name of your search here"

take a look at the data.search_props.mode field. If the indexed RT is enabled, its value should be equal to: RT indexed.

The above worked for me, hope it helps...

Cheers,
n

[hsesterhenn · Accepted solution]

Answer to myself...

Open the Job Activity screen, locate the search in question and "inpsect". Scroll down to the bottom and open "search.log".

Then search for "IndexedRealtimeSearch"...

Hope that helps.

BR

[jrodman]

"indexedRealtime": null

This is it? "null" is a bit unfortunate.

[hsesterhenn]

Thanks @mborner