We spoke recently about What does the Schedule Window option for an Alert mean?
@woodcock said there -
-- It (I assume auto
) allows splunk to shift the actual execution of that search forward in time a bit (keeping the effective timepicker value unshifted) so that Splunk can rearrange/reorder multiple scheduled searches slightly so that they don't all happen at the same time.
So, let's say the search was scheduled for 1 p.m. and with auto
it ended up running at 1:03 p.m. The search was supposed to cover 30 minutes. What would happen? which 30 minutes will be covered?
From the docs at savedsearches.conf
The same 30 minutes that would have been covered if it had run exactly on time. That is the whole point, right? Otherwise nobody would use the feature (it would be useless).
The same 30 minutes that would have been covered if it had run exactly on time. That is the whole point, right? Otherwise nobody would use the feature (it would be useless).
Gorgeous @woodcock !!!
btw, what is the time window when using auto
? is it 5 minutes?
And if the user doesn't have the capability, it seems that it's being set to auto
.