Reporting

set savedsearch schedule

New Member

Hi,

I am using Splunk Enterprise Version 6.6.6v.

Can I set the schedule setting in seconds during savedsearch configuration?

Thanks.

Tags (1)
0 Karma

Esteemed Legend

No, the minimum granularity is minutes.

0 Karma

New Member

Is there any evidence that this is not true?

0 Karma

SplunkTrust
SplunkTrust

Check the corresponding doc:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

It does not explicitly state seconds are impossible, but it states the format for crown schedules and therefore what is possible.

0 Karma

Contributor

Its not possible using cron scheduler because splunk considers cron format and the least time modifier in cron format is minutes .

Another work around is specifying * * * * * so that the it keeps running or setting the alert time to real time

Happy splunking !!

0 Karma

New Member

Is there any evidence that this is not true?

0 Karma

Contributor

The only evidence I can say is referring to https://crontab.guru/

You can find about the time modifiers supported by a cron scheduler .

Happy Splunking !!

0 Karma

New Member

Thanks!

If so, is it impossible to set the seconds in Splunk in any other way?

0 Karma