What time frame does the auto for Schedule Window cover?

[ddrillic]

We spoke recently about What does the Schedule Window option for an Alert mean?

@woodcock said there -

-- It (I assume auto) allows splunk to shift the actual execution of that search forward in time a bit (keeping the effective timepicker value unshifted) so that Splunk can rearrange/reorder multiple scheduled searches slightly so that they don't all happen at the same time.

So, let's say the search was scheduled for 1 p.m. and with auto it ended up running at 1:03 p.m. The search was supposed to cover 30 minutes. What would happen? which 30 minutes will be covered?

From the docs at savedsearches.conf

[ddrillic]

The logic is interesting for these two cases -

Is there a typo here - edit_search_schedule_window versus edit_search_window?

If we don't give the edit_search_schedule_window capability to anyone, all will be set to auto without the ability to change it - sounds good to me ; -)

[woodcock · Accepted solution]

The same 30 minutes that would have been covered if it had run exactly on time. That is the whole point, right? Otherwise nobody would use the feature (it would be useless).

[ddrillic]

Gorgeous @woodcock !!!

[ddrillic]

btw, what is the time window when using auto? is it 5 minutes?

[ddrillic]

And if the user doesn't have the capability, it seems that it's being set to auto.