https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120883#M3717 <P>So if a user has all 3, and schedule_rtsearch is removed, they can still schedule real time searches?</P> Wed, 12 Nov 2014 06:22:13 GMT shaun_dyble 2014-11-12T06:22:13Z https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120881#M3715 <P>Can someone please explain the difference between :</P> <UL> <LI>schedule_rtsearch </LI> <LI>rtsearch</LI> <LI>schedule_search</LI> </UL> <P>Does schedule_rtsearch give the user the ability to create scheduled searches that use real time? And if that ability was taken away , but the same user still had rtseach and schedule_search, would they still be able to create a scheduled search that uses real time?</P> Mon, 28 Sep 2020 18:10:33 GMT https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120881#M3715 shaun_dyble 2020-09-28T18:10:33Z https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120882#M3716 <P>Have a look here: <A href="http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6">http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6</A></P> <P>The use needs multiple capabilities to schedule a RT search</P> Wed, 12 Nov 2014 04:35:07 GMT https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120882#M3716 musskopf 2014-11-12T04:35:07Z https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120883#M3717 <P>So if a user has all 3, and schedule_rtsearch is removed, they can still schedule real time searches?</P> Wed, 12 Nov 2014 06:22:13 GMT https://community.splunk.com/t5/Security/Splunk-capability-Explanation/m-p/120883#M3717 shaun_dyble 2014-11-12T06:22:13Z