https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255584#M15990 <P>So the dispatch.earliest_time = -20m should be replaced with dispatch.earliest_time = -4h or dispatch.earliest_time = <A href="mailto:-4h@h" target="_blank">-4h@h</A>. <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/185679">@cmerriman</a> </P> Tue, 29 Sep 2020 11:59:02 GMT pavanae 2020-09-29T11:59:02Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255582#M15988 <P>I have a dashboard with cron_schedule as below. When is the cron schedule actually scheduled? And how to modify it to run every 5hr and look for time range of -4h?</P> <P>savedsearches.conf</P> <P>[My_search]<BR /> <IMG src="https://community.splunk.com/storage/temp/173347-cron.png" alt="alt text" /><BR /> dispatch.earliest_time = -20m</P> Tue, 29 Sep 2020 11:58:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255582#M15988 pavanae 2020-09-29T11:58:46Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255583#M15989 <P>cron_schedule = 20 /1 runs every hour on the 20th minute.</P> <P>for every 5 hours:<BR /> cron_schedule = <CODE>0 */5 * * *</CODE></P> <P>to have a range of 4 hours, you'll have to use the <CODE>earliest=-4h@h</CODE> and <CODE>latest=now</CODE> in your search</P> Mon, 05 Dec 2016 16:01:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255583#M15989 cmerriman 2016-12-05T16:01:09Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255584#M15990 <P>So the dispatch.earliest_time = -20m should be replaced with dispatch.earliest_time = -4h or dispatch.earliest_time = <A href="mailto:-4h@h" target="_blank">-4h@h</A>. <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/185679">@cmerriman</a> </P> Tue, 29 Sep 2020 11:59:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255584#M15990 pavanae 2020-09-29T11:59:02Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255585#M15991 <P>right. @h will snap it to the beginning of the hour.</P> Mon, 05 Dec 2016 19:52:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255585#M15991 cmerriman 2016-12-05T19:52:46Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255586#M15992 <P>Could you also tell me the difference between -4h@h and -4h please? Thanks @cmerriman.</P> Mon, 05 Dec 2016 21:20:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255586#M15992 pavanae 2016-12-05T21:20:16Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255587#M15993 <P>For example, if time was 5:06, -4h@h would put the earliest time at 1:00, but -4h would put it at 1:06. Does that make sense?</P> Tue, 06 Dec 2016 00:10:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255587#M15993 cmerriman 2016-12-06T00:10:17Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255588#M15994 <P>yes thank you very much. @cmerriman.</P> Tue, 06 Dec 2016 14:54:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-adjust-the-cron-schedule-of-a-dashboard/m-p/255588#M15994 pavanae 2016-12-06T14:54:43Z