Splunk recommends as a Best Practice that real-time alerts be converted to "smallest reasonable repetition" so as to better manage resources. (real time takes a core and does not give it back). In line with that recommendation it would be helpful to make using the more granular "CRONTAB" notation easier to use by putting a bit of intelligence behind that text box.
At minimum testing the validity before allowing someone to save
At maximum, intelligently suggesting examples. (CRONTAB syntax is not likely to change without us knowing)
Resources like https://crontabguru.com are wonderful - but we should at least take the bullets out of the gun.
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
