Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

What is the difference between indexed real-time vs scheduled search every minute for the previous minute?

$
0
0
I understand that indexed real-time searches are not up to the second and lag (default of 60 sec) behind a real-time search. With this being the case, what is the difference between these two searches? **Scheduled search:** **savesearches.conf** cron_schedule = * * * * * dispatch.earliest_time = -1m dispatch.latest_time = now AND **Indexed real-time search ** **limits.conf** indexed_realtime_disk_sync_delay = 60

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>