Cron Schedule Templates

Instead of providing a fixed minute on which a scheduled search or scheduled report should run, a template can be provided by specifying the character H in the UI, which will run a scheduled search or scheduled report at a random but fixed minute past the hour (based on the hash of the ID) — see figure below:

Cron Schedule with Template

Figure 192. Cron Schedule with Template


The smallest interval that can be configured is every minute, using:

cron
* * * * *

Care should be taken with such small increments as this may increase the load on the cluster.

When using H, the template will pick a number in the range [0-59] for the minute when the operation should run, and all consecutive operations will run on the same minute. The operation will run at a fixed arbitrary minute past every hour, meaning, for example, that if a search is made with the cron expression schedule:

cron
H * * * *

and if the minute chosen is 48, the search will run at 00:48, 01:48, 02:48 etc. This is only supported for minutes and only a lone H is supported. The interval cannot be controlled or modified, for example by using notation such as H/15, or H-15.

Note

The use of a self-selected minute for execution by LogScale is designed to spread the load of scheduled search or scheduled report execution.