I would like to know how exactly scheduled saved search works.
I've a saved search for which I gave the time range as -24h@h to @h & scheduled it to run every 24 hours.
gkanapathy is right, I'm not asking about summarized index at all in my question.
If the scheduled search is not storing results in any index, then what's the purpose of scheduling it to run every 24 hours or any time period???? I mean what will it do? Will it just run without any purpose?
it is not stored in any index, but in your job list if you ever saved it. otherwise it will be erased after its expiration time. see http://docs.splunk.com/Documentation/Splunk/4.2.3/User/ManageYourSearchJobs
Can you please clarify?? The doc is not that clear...I can see that the scheduled searches appear in the job list but whats the purpose? I mean what should I do with job list, I thought jobs are just for troubleshooting...
What is the overall purpose of scheduling search, say every 24 hours, can any one give an example with details?