Cron Schedule Templates
Instead of providing a fixed minute on which a scheduled search or
scheduled report should run, a template can be provided by specifying the
character H
in the UI, which will
run a scheduled search or scheduled report at a random but fixed minute
past the hour (based on the hash of the ID) — see figure below:
Figure 201. Cron Schedule with Template
Time specification is always based on UTC time, and not localised to the timezone where the server is located. To change the basis for the offset, set the UTC offset to the chosen timeszone.
The smallest interval that can be configured is every minute, using:
* * * * *
Care should be taken with such small increments as this may increase the load on the cluster.
When using H
, the template will pick a number in the
range [0-59]
for the minute when the
operation should run, and all consecutive operations will run on the same
minute. The operation will run at a fixed arbitrary minute past every
hour, meaning, for example, that if a search is made with the cron
expression schedule:
H * * * *
and if the minute chosen is 48, the search will run at 00:48, 01:48, 02:48
etc. This is only supported for minutes and only a lone
H
is supported. The interval cannot be
controlled or modified, for example by using notation such as
H/15
, or
H-15
.
Note
The use of a self-selected minute for execution by LogScale is designed to spread the load of scheduled search or scheduled report execution.