Is possible to change the Cron Expression directly from a dashboard?

[robertcoanca]

Hello everyone,

I've created a dedicated dashboard that contains a table, which displays the latest update of the saved searches, their status, user, but also the value from the Cron Schedule, to be able to have a daily overview, like a health monitor of the saved searches.

Would it be possible to change the Cron schedule value directly from my dashboard, without having to run from the dedicated page where all the saved searches are located?

Thank you!

[robertcoanca]

Hi Giuseppe,

Thank you for your answer!

I thought from the beginning that I would need Javascript in order to develop this ...

In the meantime, I found an alternative solution.

I have set links for each saved search that directs me to the Searches, Reports, and Alerts and Job Manager page and so I can access all the saved search options, not just the Cron schedule.

[gcusello · Accepted solution]

Hi @robertcoanca,

In Splunk dashboards, you display data in indexes or lookups taken by scripts or other inputs.

This means that you don't have a direct access to the sources.

To do what you're speaking, you should create a JavaScript that execute the command to modify crontable and integrate it in your dashboard, but in this way you're enabling Splunk users to execute root commands!

In other words: it's possible but it isn't easy and surely not a good idea!

Ciao.

Giuseppe