saved search reverts to cron scheduling type when changing interval to 15 minutes

Path Finder

I am running Splunk 4.2.3 and have a number of saved searches set up to run on varying schedules. All of these are set up using "basic" scheduling type. If I edit one of these via Manager - Searches & Reports and change the "Run every" setting from whatever time it is to 15 minutes and save the search, then go back into the saved search via Manager, the scheduling type has changed from basic to cron.

I have tested this in multiple browsers, as well as verifying this doesn't happen if changing the "Run every" setting to something OTHER than 15 minutes (1 minute, 30 minutes, hourly, etc...).

Any thoughts?


Tags (2)


@woodcock is correct that this seems to be a bug. And being an old question, this is now an old bug. However it is a fallacy to simply believe that old bugs are indeed "fixed long ago." As a community, if we believe a bug to be squashed, a good answer would be to try to reproduce it on an installation available to us so that we can report that as of a particular version the bug is not reproducible. An amazing answer however would go a step further and find the SPL number, and the exact version as to where it was resolved since just upgrading to the latest version is not always the correct answer. (While it's ideal to always be on the latest version, if the latest version is right for my organization is a function of what known bugs exist in the latest version compared to what features we use, and what resources are there to perform the upgrades).

The issue as described in this question is reproducible in the current latest version (6.2.3) therefore I filed P4 case 242921 on the OP's behalf.

Now those of you familiar with Splunk's case priority levels might be asking why a P4 if this is a bug? Well, you see, while it is unexpected to save as a basic schedule and load as a cron schedule and therefore technically a bug, the cron schedule that is loaded here is in actually */15 * * * * which is cron for run every 15 minutes. So it's an annoyance, but not in fact a correctness issue. Historically with Splunk these sorts of bugs tend to hang around a long time (The classic one I always remember is one from before 4.3 where saving permissions on certain knowledge objects would dump you to the main manager page instead of the list of knowledge objects where you were previously. I know this one was around through at least 6.0, it seems like it may have been fixed before 6.2.3, but I haven't tested enough to know for certain).

Esteemed Legend

I am sure this is a bug and sure that it was fixed long ago.

0 Karma

Esteemed Legend

For all you downvoters, you should know that there has never been a way (and still isn't) for a contractor (even a fully-fledged Splunk Partner, even a member of the Splunk Trust) to open a case with Splunk if we have never bought any Splunk license to give us the "entitlement" to do so. Otherwise I would be MUCH more serious about investigating AND REPORTING bugs.

0 Karma