"Real-Time" search presets not available in the time picker in Splunk UI

Applicability

Description

“Real-Time” time range presets are missing from the time picker, limiting the ability to perform real time searches through the UI

Affecting all users across all authentication methods

Investigation

Confirm if the roles in question do have the rtsearch capability in authorize.conf or directly through the UI per the Define roles on the Splunk platform with capabilities documentation

/opt/splunk/bin/splunk btool authorize list --debug role_<your_role>

Confirm if users can actually run CLI searches

/opt/splunk/bin/splunk rtsearch [object][-parameter <value>]
i.e.
/opt/splunk/bin/splunk rtsearch 'index=_internal' -earliest_time 'rt-30s'  -latest_time 'rt+30s

And also REST API searches

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head 1"

Resolution

Confirm if the show_realtime setting is disabled in [settings] in times.conf

[settings]
show_realtime = false

/opt/splunk/bin/splunk btool times list --debug settings

If it is, enable it back.

If results show it's indeed enabled; double-check this settings by using the following SPL

| rest /servicesNS/-/search/data/ui/times count=0 | table title, label, earliest_time, latest_time, disabled, eai:appName, sub_menu

This will indicate if search heads are actually serving any real-time presets and, if so, whether they're disabled and which app they come from