Splunk Search

Saved Scheduled Searches???

freephoneid
Path Finder

Hi,

I would like to know how exactly scheduled saved search works.

I've a saved search for which I gave the time range as -24h@h to @h & scheduled it to run every 24 hours.

  1. When it runs every 24 hrs, does it store the results in the original index as I did not see an option to specify index.
  2. Within this 24 hr period, if I invoke the search through dashboard using this scheduled search, will it give the same result?
  3. When is this 24 hr period starts exactly? Does it start when I schedule the search?

Thanks!

Tags (1)
0 Karma

freephoneid
Path Finder

Hi,

Can you please clarify?? The doc is not that clear...I can see that the scheduled searches appear in the job list but whats the purpose? I mean what should I do with job list, I thought jobs are just for troubleshooting...

What is the overall purpose of scheduling search, say every 24 hours, can any one give an example with details?

0 Karma

freephoneid
Path Finder

Hi,

gkanapathy is right, I'm not asking about summarized index at all in my question.

If the scheduled search is not storing results in any index, then what's the purpose of scheduling it to run every 24 hours or any time period???? I mean what will it do? Will it just run without any purpose?

Thanks!

0 Karma

hjwang
Contributor

it is not stored in any index, but in your job list if you ever saved it. otherwise it will be erased after its expiration time. see http://docs.splunk.com/Documentation/Splunk/4.2.3/User/ManageYourSearchJobs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...