From trial and error, it seems that the cron expression supported here is the same as for scheduled alerts:
and that is the 5 field version corresponding to correspond to minute hour day-of-month month day-of-week. See the Wikipedia entry for Cron for details:
I suspect the incorrect hint text comes from the fact that there is also a Splunk Add-on for Microsoft PowerShell (https://splunkbase.splunk.com/app/1477/) that was implemented using Quartz.net (http://www.quartz-scheduler.net/) which has a different cron expression syntax for cron triggers (http://www.quartz-scheduler.net/documentation/quartz-2.x/tutorial/crontriggers.html ).
It seems that the built-in PowerShell v3 Modular Input that comes with Splunk 6.3+ shares the same implementation as as other parts of the Splunk platform. The documentation for the PowerShell Modular Input: http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/MonitorWindowsdatawithPowerShellscripts uses the correct format for the examples although is still incorrectly includes a link to the Quartz.net implementation.
It makes sense that Splunk would not want you to be triggering these scripts with a more granular time scale than minutes so the lack of seconds support seems to fit.
... View more