Splunk Enterprise Security

How is the cron_schedule_map lookup in the SA-Utils app of Splunk Enterprise Security used?

jdeer0618
Explorer

There is a lookup in the SA-Utils app called "cron_schedule_map.csv" and I was wondering if any one out there knows how it is leveraged in ES. Attached is what the first few rows look like.

Thanks,
JD

alt text

0 Karma
1 Solution

LukeMurphey
Champion

This lookup exists only to provide information as to when searches run. It isn't really used for anything in the app (i.e. isn't used to drive scripts or searches).

The main reason it exists is to help people who are writing searches to find times that not filled with other searches running at the same time (so that you can space them out).

View solution in original post

LukeMurphey
Champion

This lookup exists only to provide information as to when searches run. It isn't really used for anything in the app (i.e. isn't used to drive scripts or searches).

The main reason it exists is to help people who are writing searches to find times that not filled with other searches running at the same time (so that you can space them out).

jdeer0618
Explorer

Thanks, LukeMurphey. Just what I was looking for.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...