topic Re: Savedsearch next scheduled time is different from cron schedule set in Splunk Search

Savedsearch next scheduled time is different from cron schedule set

Poojitha — Tue, 18 Mar 2025 05:28:18 GMT

Hi All,

I have scheduled a splunk report to run at 11 AM IST everyday (cron schedule : 0 11 * * *). Search Head time zone is IST.

But when I checked savedsearch , the next scheduled time is shown as 4:30 PM IST though advance settings has 0 11 * * *.

Until yesterday it was fine . But suddenly seeing this issue. Does anyone has idea what is going wrong ?

Regards,
Poojitha NV

Re: Savedsearch next scheduled time is different from cron schedule set

livehybrid — Tue, 18 Mar 2025 07:00:58 GMT

Hi @Poojitha

It sounds like your search is running to 11am UTC which I believe is 16:30 IST? (UTC+5.5hr)

This is likely because the owner of the search has their timezone set to UTC - Is the search owned by your account, or a service account? Can you confirm that the account has the timezone set correctly to IST?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Savedsearch next scheduled time is different from cron schedule set

Poojitha — Tue, 18 Mar 2025 07:14:37 GMT

@livehybrid You are correct. I realised it later.

I have my SH set with timezone IST. So same I had considered and had given 11 AM as schedule. But splunk server has its timezone set in UTC. So it is considering 11 AM as UTC which is 4:30 PM IST. And so I am seeing it 🙂 Thanks for your response.