set savedsearch schedule

[kind7776]

Hi,

I am using Splunk Enterprise Version 6.6.6v.

Can I set the schedule setting in seconds during savedsearch configuration?

Thanks.

[woodcock]

No, the minimum granularity is minutes.

[kind7776]

Is there any evidence that this is not true?

[xpac]

Check the corresponding doc:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

It does not explicitly state seconds are impossible, but it states the format for crown schedules and therefore what is possible.

[ssadanala1]

Its not possible using cron scheduler because splunk considers cron format and the least time modifier in cron format is minutes .

Another work around is specifying * * * * * so that the it keeps running or setting the alert time to real time

Happy splunking !!

[kind7776]

Is there any evidence that this is not true?

[ssadanala1]

The only evidence I can say is referring to https://crontab.guru/

You can find about the time modifiers supported by a cron scheduler .

Happy Splunking !!

[kind7776]

Thanks!

If so, is it impossible to set the seconds in Splunk in any other way?