https://community.splunk.com/t5/Splunk-Search/How-does-a-Schedule-Saved-Search-work/m-p/12972#M1104 <P>No, scheduled searches are not that smart. It will run over 'All Time' every time it runs, that is the time-range that you have originally configured.</P> <P>I realise that this is only an example, but in general, 'all time' searches are very resource intensive and scheduled searches should be optimized as much as possible. If you want to run a search every 24 hours, then you only need to search the last 24 hours - starthoursago=24 - similarly, if you're running an hourly search, you'll want to specify something like starthoursago=1</P> Thu, 06 May 2010 09:51:59 GMT mctester 2010-05-06T09:51:59Z https://community.splunk.com/t5/Splunk-Search/How-does-a-Schedule-Saved-Search-work/m-p/12971#M1103 <P>Hi </P> <P>I have a question about the workings of the scheduled saved search. Suppose I have a slow-running search that has been scheduled to run every day. The time-range for this search is All-Time. Does the search run over the "all-time" period for every consecutive run after a successful previous run? Or is it smart enough to run only for the delta of the elapsed time between the last successful run and the present time? </P> <P>Thanks for your input. </P> <P>Ranga</P> Thu, 06 May 2010 05:23:29 GMT https://community.splunk.com/t5/Splunk-Search/How-does-a-Schedule-Saved-Search-work/m-p/12971#M1103 sranga 2010-05-06T05:23:29Z https://community.splunk.com/t5/Splunk-Search/How-does-a-Schedule-Saved-Search-work/m-p/12972#M1104 <P>No, scheduled searches are not that smart. It will run over 'All Time' every time it runs, that is the time-range that you have originally configured.</P> <P>I realise that this is only an example, but in general, 'all time' searches are very resource intensive and scheduled searches should be optimized as much as possible. If you want to run a search every 24 hours, then you only need to search the last 24 hours - starthoursago=24 - similarly, if you're running an hourly search, you'll want to specify something like starthoursago=1</P> Thu, 06 May 2010 09:51:59 GMT https://community.splunk.com/t5/Splunk-Search/How-does-a-Schedule-Saved-Search-work/m-p/12972#M1104 mctester 2010-05-06T09:51:59Z