topic Splunk Alert with UTC Cron expression in Alerting

Splunk Alert with UTC Cron expression

SaintNick — Fri, 14 Jun 2024 13:20:06 GMT

Our Splunk runs in local time, and Splunk Alerts with a Cron schedule and a cron expression such as "00 4,8,12,18 * * *" will run four times a day at the given LOCAL times. How can I tell it to run at UTC times?

Re: Splunk Alert with UTC Cron expression

gcusello — Fri, 14 Jun 2024 13:42:09 GMT

Hi @SaintNick ,

Splunk uses the timezone of the operative system, but in the interface displays data considering the user timezone, but anyway cron remains the one of the OS.

The only way is consider this in the cron definition, I don't know a method to apply timezones to the cron.

Ciao.

Giuseppe

Re: Splunk Alert with UTC Cron expression

SaintNick — Mon, 17 Jun 2024 11:51:57 GMT

Thanks Guiseppe, that's exactly what I want to know, how to tell the cron to run in UTC times.

Re: Splunk Alert with UTC Cron expression

SaintNick — Mon, 17 Jun 2024 12:00:16 GMT

Call out to any Splunk engineer or moderator to answer this simple question!

Re: Splunk Alert with UTC Cron expression

inventsekar — Mon, 17 Jun 2024 12:12:01 GMT

Hi @SaintNick ...the stackexchange gave this one:

https://unix.stackexchange.com/questions/710815/how-do-i-make-cron-use-utc

if u r using windows or if the above idea didnt work, if u r looking for a simple short-cut, simply convert the time to UTC time manually and update the cron accordingly.

Re: Splunk Alert with UTC Cron expression

gcusello — Mon, 17 Jun 2024 12:37:24 GMT

Hi @SaintNick ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

Re: Splunk Alert with UTC Cron expression

SaintNick — Mon, 17 Jun 2024 13:17:42 GMT

Thanks @inventsekar, I don't have or want access to the Splunk system or user files. I only have access through the Web UI.

The Splunk documentation at https://docs.splunk.com/Documentation/Splunk/9.2.0/Alert/CronExpressions actually states:

You can customize alert scheduling using a time range and cron expression. The Splunk cron analyzer defaults to the timezone where the search head is configured. This can be verified or changed by going to Settings > Searches, reports, and alerts > Scheduled time.

But then nowhere below do they explain how to change the timezone for the cron schedule. And when I go to my alert and choose "Advanced Edit", I get a huge page with ~450 fields but nowhere the time zone. There is the field cron_schedule (and next_scheduled_time) but again, no way to change the time zone for the schedule.

So I conclude, it's simply not possible.