Splunk Search

Plan searches for future events


Hello everybody,

Is there a configuration file that an application(written on my own) can edit to plan searches? What I need is to plan searches for retrieving event coming in the future. And, if this file exist, it is possible to set searches to start automatically?

0 Karma


savedsearches.conf is where you can define and schedule searches. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!