Saved Scheduled Searches???

[freephoneid]

Hi,

I would like to know how exactly scheduled saved search works.

I've a saved search for which I gave the time range as -24h@h to @h & scheduled it to run every 24 hours.

1. When it runs every 24 hrs, does it store the results in the original index as I did not see an option to specify index.
2. Within this 24 hr period, if I invoke the search through dashboard using this scheduled search, will it give the same result?
3. When is this 24 hr period starts exactly? Does it start when I schedule the search?

Thanks!

[freephoneid]

Hi,

Can you please clarify?? The doc is not that clear...I can see that the scheduled searches appear in the job list but whats the purpose? I mean what should I do with job list, I thought jobs are just for troubleshooting...

What is the overall purpose of scheduling search, say every 24 hours, can any one give an example with details?

[freephoneid]

Hi,

gkanapathy is right, I'm not asking about summarized index at all in my question.

If the scheduled search is not storing results in any index, then what's the purpose of scheduling it to run every 24 hours or any time period???? I mean what will it do? Will it just run without any purpose?

Thanks!

[hjwang]

it is not stored in any index, but in your job list if you ever saved it. otherwise it will be erased after its expiration time. see http://docs.splunk.com/Documentation/Splunk/4.2.3/User/ManageYourSearchJobs