Can someone please explain the difference between :
Does schedule_rtsearch give the user the ability to create scheduled searches that use real time? And if that ability was taken away , but the same user still had rtseach and schedule_search, would they still be able to create a scheduled search that uses real time?
So if a user has all 3, and schedule_rtsearch is removed, they can still schedule real time searches?
Have a look here: http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6
The use needs multiple capabilities to schedule a RT search