Splunk SOAR Certified Automation Developer — Question 38

ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?

Answer options

• A. If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.
• B. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.
• C. If this value is set to 0, the scheduler may skip scheduled execution periods.
• D. If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.

Correct answer: B

Explanation

The correct answer is B because setting realtime_schedule to 0 means the scheduler will use the last search execution time to determine the next execution. Options A, C, and D incorrectly describe the scheduler's behavior in this configuration, focusing instead on current time or potential skips rather than the reliance on the last execution time.