Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Splunk alert/reports
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have a search head in eastern time and user is configured in Asia time.
so if i configure a report/alert in which time the reports wil be executed. whether user time or search head time.
so if user scheduling a cron on his timezone to run at 6PM.. what time zone the report will run whether search head time or user timezone
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj,
User time zone is just to present you results in your time zone but the searches will be still run on the server time. Please see below post more information!
https://answers.splunk.com/answers/232647/what-timezone-does-my-scheduled-search-run-in.html
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj,
User time zone is just to present you results in your time zone but the searches will be still run on the server time. Please see below post more information!
https://answers.splunk.com/answers/232647/what-timezone-does-my-scheduled-search-run-in.html
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so if server is Eastern time and user in asia time. if user considering to get last 4 hours data of user time.. what time zone data we will user get?
Eastern standard time data with replaced in user time zone or user time with eastern standard time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj,
Here is an example :
- My server is set to Asia time (Singapore)
- User settings is set to Alaska (US)
- Time range selected for last 15 minutes at 9:44 PM
Time shown in _time : 7/26/18 5:44:23.356 AM
Time of events : 127.0.0.1 - admin [26/Jul/2018:21:44:23.356 +0800]
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would be user timezone.
Because, while search displaying the results user time will be considered. In the same way for scheduled alerts also user time will be considered.
If this helps, give a like below.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
