Changing Cron Sceheduling Saved Search

diliptmonson · ‎08-17-2016

I am utilizing around 40 saved searches which runs on a CRON scheduler to populate various summary indexes. If there is an issue with underlying data, I want to stop all the saved searches and run it a different time (let's say 3 hours from the time of earlier schedule).

Is there a way in Splunk to change the timings of all scheduled searches in one go

hardikJsheth · ‎08-17-2016

I think you can do that.

You need to enable a script execution from a particular saved search. Then from the python script you can update cron schedule for each alert.

Changing Cron Sceheduling Saved Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Changing Cron Sceheduling Saved Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future