Changing Cron Sceheduling Saved Search

diliptmonson · ‎08-17-2016

I am utilizing around 40 saved searches which runs on a CRON scheduler to populate various summary indexes. If there is an issue with underlying data, I want to stop all the saved searches and run it a different time (let's say 3 hours from the time of earlier schedule).

Is there a way in Splunk to change the timings of all scheduled searches in one go

hardikJsheth · ‎08-17-2016

I think you can do that.

You need to enable a script execution from a particular saved search. Then from the python script you can update cron schedule for each alert.

Changing Cron Sceheduling Saved Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026

Join the Conversation

Changing Cron Sceheduling Saved Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026