I've got hundreds of searches that are scheduled ervry night from 00:00 to 6:00. It does not matter when they will be finished unless it is before 7:00.
What is the best approach to use the new scheduler in Splunk 6.3 for this usecase? As far as understand it, it could be a good option to schedule all searches at 00:00 and setup a window of 6 hours. So the scheduler would be able to run the searches most efficently. Is this a correct assumption or could it cause problems to schedule all search at once?