topic Saved Scheduled Searches??? in Splunk Search

Saved Scheduled Searches???

freephoneid — Fri, 30 Sep 2011 20:23:50 GMT

Hi,

I would like to know how exactly scheduled saved search works.

I've a saved search for which I gave the time range as -24h@h to @h & scheduled it to run every 24 hours.

When it runs every 24 hrs, does it store the results in the original index as I did not see an option to specify index.
Within this 24 hr period, if I invoke the search through dashboard using this scheduled search, will it give the same result?
When is this 24 hr period starts exactly? Does it start when I schedule the search?

Thanks!

Re: Saved Scheduled Searches???

freephoneid — Sun, 02 Oct 2011 20:34:37 GMT

Hi,

gkanapathy is right, I'm not asking about summarized index at all in my question.

If the scheduled search is not storing results in any index, then what's the purpose of scheduling it to run every 24 hours or any time period???? I mean what will it do? Will it just run without any purpose?

Thanks!

Re: Saved Scheduled Searches???

hjwang — Mon, 03 Oct 2011 01:25:21 GMT

it is not stored in any index, but in your job list if you ever saved it. otherwise it will be erased after its expiration time. see http://docs.splunk.com/Documentation/Splunk/4.2.3/User/ManageYourSearchJobs

Re: Saved Scheduled Searches???

freephoneid — Mon, 03 Oct 2011 03:45:37 GMT

Hi,

Can you please clarify?? The doc is not that clear...I can see that the scheduled searches appear in the job list but whats the purpose? I mean what should I do with job list, I thought jobs are just for troubleshooting...

What is the overall purpose of scheduling search, say every 24 hours, can any one give an example with details?