Interesting question. I'm not sure that you can with Splunk's cron notation. If the search doesn't consume many resources, just run it every hour. Otherwise I suppose you could: Make a saved search Use cron or a bash script on a linux host to run saved/searches/{name}/dispatch http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch Check out http://stackoverflow.com/questions/1417098/cronjob-every-25-hours I'm curious: what use case do you have for this search? ... View more

Thanks Alacercogitatus for the reply. I have executed your search query that is working fine. This query is also helpful for me, but here I have different requirement as following. Host SourceType Status host_1 sourcetype_1 Sending data host_1 sourcetype_2 sending data host_1 sourcetype_3 Not sending data for Last 24 hours host_2 sourcetype_1 sending data host_2 sourcetype_2 Not sending data for last 24 hours host_2 sourcetype_3 sending data Required OutPut: host_1 Sourcetype_3 LastTime host_2 sourcetype_2 LastTime ... View more

Possibly but I think it would be highly inadvisable. ... View more

https://answers.splunk.com/answers/653458/max-time-spent-in-per-result-alerts-issue.html limits.conf [scheduler] action_execution_threads = 10 actions_queue_size = 10000 max_per_result_alerts =10000 max_per_result_alerts_time = 600 ... View more