Instead of providing a fixed minute on which a scheduled search or scheduled report should run, a template can be provided by specifying the character H in the UI, which will run a scheduled search or scheduled report at a random but fixed minute past the hour (based on the hash of the ID) — see figure below:

Figure 205. Cron Schedule with Template

Time specification is always based on UTC time, and not localised to the timezone where the server is located. To change the basis for the offset, set the UTC offset to the chosen timeszone.

The smallest interval that can be configured is every minute, using:

* * * * *

Care should be taken with such small increments as this may increase the load on the cluster.

When using H, the template will pick a number in the range [0-59] for the minute when the operation should run, and all consecutive operations will run on the same minute. The operation will run at a fixed arbitrary minute past every hour, meaning, for example, that if a search is made with the cron expression schedule:

H * * * *

and if the minute chosen is 48, the search will run at 00:48, 01:48, 02:48 etc. This is only supported for minutes and only a lone H is supported. The interval cannot be controlled or modified, for example by using notation such as H/15, or H-15.