How to adjust the cron_schedule of a dashboard?

[pavanae]

I have a dashboard with cron_schedule as below. When is the cron schedule actually scheduled? And how to modify it to run every 5hr and look for time range of -4h?

savedsearches.conf

[My_search]

dispatch.earliest_time = -20m

[cmerriman · Accepted solution]

cron_schedule = 20 /1 runs every hour on the 20th minute.

for every 5 hours:
cron_schedule = 0 */5 * * *

to have a range of 4 hours, you'll have to use the earliest=-4h@h and latest=now in your search

[pavanae]

So the dispatch.earliest_time = -20m should be replaced with dispatch.earliest_time = -4h or dispatch.earliest_time = -4h@h. @cmerriman

[cmerriman]

right. @h will snap it to the beginning of the hour.

[pavanae]

Could you also tell me the difference between -4h@h and -4h please? Thanks @cmerriman.

[cmerriman]

For example, if time was 5:06, -4h@h would put the earliest time at 1:00, but -4h would put it at 1:06. Does that make sense?

[pavanae]

yes thank you very much. @cmerriman.