Which time range picker configuration would return real-time events for the past 30 seconds?
Which time range picker configuration would return real-time events for the past 30 seconds?
To return real-time events for the past 30 seconds, the appropriate configuration should logically include a real-time element. Therefore, the configuration 'Real-time - Earliest: 30-seconds ago, Latest: Now' is correct as it indicates monitoring events in real-time from 30 seconds ago up to the current moment.
C is correct https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Selecttimerangestoapply
C. Real-time - Earliest: 30-seconds ago, Latest: Now
Not sure why people are saying C, since in the time picker there is no "real-time" option - just presets, relative, date range, date and time range, and advanced. The only option that works with "earliest" and "latest" options using "30-seconds ago" and "Now" values, respectively, is the relative option; so B.
C is the right answer