Getting Data In

Any way to tell a saved search to run under a certain timezone?

jonahzirkle
Engager

We are running into an issue where we have multiple users across the country; specifically MST. Data resideds on a server in CST. The users in MST is responsible for the searches/alerts and ran into a problem w/false alerts. We've discovered that it's because the saved search runs under the timezone of the user who created it.

I can think of a few workarounds but I want to know if there is a way to instruct splunk to run the scheduled search under a certain timezone?

Tags (2)
1 Solution

MuS
Legend

Hi jonahzirkle,

just had a similar problem with EST and GMT log files. We fixed it by creating a dummy user with the needed TZ settings and ran the seaved searches under this dummy user account.

You need to transfer the owner of the saved search to this dummy user either by login in as this user and create the saved searches or edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta
and change each needed occurrence to the dummy ower’s ID. Splunk needs to be restarted for these changes to take effect.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi jonahzirkle,

just had a similar problem with EST and GMT log files. We fixed it by creating a dummy user with the needed TZ settings and ran the seaved searches under this dummy user account.

You need to transfer the owner of the saved search to this dummy user either by login in as this user and create the saved searches or edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta
and change each needed occurrence to the dummy ower’s ID. Splunk needs to be restarted for these changes to take effect.

hope this helps ...

cheers, MuS

anewell
Path Finder

We're facing the same timezone spanning problem, and I had also dreamed up the the 'dummy user' solution. I was looking for evidence of prior art, so thank you for the confirmation, MuS!

0 Karma

MuS
Legend

you're welcome, please feel free to mark this as answered.

0 Karma

jonahzirkle
Engager

Thank you for the response. This and just adjusting the schedule by the hour were good workarounds. Was really hoping Splunk had an option I might've been overlooking.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...