Any way to tell a saved search to run under a certain timezone?

[jonahzirkle]

We are running into an issue where we have multiple users across the country; specifically MST. Data resideds on a server in CST. The users in MST is responsible for the searches/alerts and ran into a problem w/false alerts. We've discovered that it's because the saved search runs under the timezone of the user who created it.

I can think of a few workarounds but I want to know if there is a way to instruct splunk to run the scheduled search under a certain timezone?

[MuS · Accepted solution]

Hi jonahzirkle,

just had a similar problem with EST and GMT log files. We fixed it by creating a dummy user with the needed TZ settings and ran the seaved searches under this dummy user account.

You need to transfer the owner of the saved search to this dummy user either by login in as this user and create the saved searches or edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta and change each needed occurrence to the dummy ower’s ID. Splunk needs to be restarted for these changes to take effect.

hope this helps ...

cheers, MuS

[anewell]

We're facing the same timezone spanning problem, and I had also dreamed up the the 'dummy user' solution. I was looking for evidence of prior art, so thank you for the confirmation, MuS!

[MuS]

you're welcome, please feel free to mark this as answered.

[jonahzirkle]

Thank you for the response. This and just adjusting the schedule by the hour were good workarounds. Was really hoping Splunk had an option I might've been overlooking.