Alert schedule cleanup

[alekwisnia]

I got a bunch of alerts and reports scheduled - unfortunately most of them are scheduled for the same time. Is it possible to automatically review and correct those times? Does Splunk enterprise security have any "collision avoidance" mechanism in order to prevent that from happening while creating new corellation searches?

[richgalloway]

Splunk has Schedule Windows and Skew which allow for colliding searches to run slightly after their scheduled times, but there is no mechanism to automatically reschedule searches.  It's up to you to do that.