topic Re: set savedsearch schedule in Reporting

set savedsearch schedule

kind7776 — Thu, 03 May 2018 01:35:27 GMT

Hi,

I am using Splunk Enterprise Version 6.6.6v.

Can I set the schedule setting in seconds during savedsearch configuration?

Thanks.

ssadanala1 — Thu, 03 May 2018 03:24:52 GMT

Its not possible using cron scheduler because splunk considers cron format and the least time modifier in cron format is minutes .

Another work around is specifying * * * * * so that the it keeps running or setting the alert time to real time

Happy splunking !!

woodcock — Thu, 03 May 2018 03:30:40 GMT

No, the minimum granularity is minutes.

kind7776 — Thu, 03 May 2018 05:47:36 GMT

Is there any evidence that this is not true?

kind7776 — Thu, 03 May 2018 05:48:53 GMT

Is there any evidence that this is not true?

ssadanala1 — Thu, 03 May 2018 05:59:51 GMT

The only evidence I can say is referring to https://crontab.guru/

You can find about the time modifiers supported by a cron scheduler .

Happy Splunking !!

kind7776 — Thu, 03 May 2018 07:04:17 GMT

Thanks!

If so, is it impossible to set the seconds in Splunk in any other way?

xpac — Thu, 03 May 2018 08:24:34 GMT

It does not explicitly state seconds are impossible, but it states the format for crown schedules and therefore what is possible.