Cron Schedule Templates
Instead of providing a fixed minute on which a scheduled search or
scheduled report should run, a template can be provided by specifying the
character H
in the UI, which will
run a scheduled search or scheduled report at a random but fixed minute
past the hour (based on the hash of the ID) — see figure below:
![]() |
Figure 178. Cron Schedule with Template
The smallest interval that can be configured is every minute, using:
* * * * *
Care should be taken with such small increments as this may increase the load on the cluster.
When using H
, the template will pick a number in the
range [0-59]
for the minute when the
operation should run, and all consecutive operations will run on the same
minute. The operation will run at a fixed arbitrary minute past every
hour, meaning, for example, that if a search is made with the cron
expression schedule:
H * * * *
and if the minute chosen is 48, the search will run at 00:48, 01:48, 02:48
etc. This is only supported for minutes and only a lone
H
is supported. The interval cannot be
controlled or modified, for example by using notation such as
H/15
, or
H-15
.
Note
The use of a self-selected minute for execution by LogScale is designed to spread the load of scheduled search or scheduled report execution.