Splunk capability Explanation

[shaun_dyble]

Can someone please explain the difference between :

• schedule_rtsearch
• rtsearch
• schedule_search

Does schedule_rtsearch give the user the ability to create scheduled searches that use real time? And if that ability was taken away , but the same user still had rtseach and schedule_search, would they still be able to create a scheduled search that uses real time?

[shaun_dyble]

So if a user has all 3, and schedule_rtsearch is removed, they can still schedule real time searches?

[musskopf]

Have a look here: http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6

The use needs multiple capabilities to schedule a RT search