This recipe was as much about real-time alerting as it was about real-time searching. Real-time searching has limited value on its own, unless you are staring at the screen, waiting for data to come into Splunk. However, when paired with alerting, this functionality really comes into its own. Real-time searches and alerts can be more taxing on system resources than their scheduled counterparts, so care should be taken to ensure that they are efficient and delivering value. The Jobs screen can clarify which real-time searches are running on your system. Additionally, alerts can be configured directly by editing the savedsearches.conf configuration file.
Indexed real-time searches can be enabled to increase performance and reduce ...
