Getting Data In

Any way to tell a saved search to run under a certain timezone?

jonahzirkle
Engager

We are running into an issue where we have multiple users across the country; specifically MST. Data resideds on a server in CST. The users in MST is responsible for the searches/alerts and ran into a problem w/false alerts. We've discovered that it's because the saved search runs under the timezone of the user who created it.

I can think of a few workarounds but I want to know if there is a way to instruct splunk to run the scheduled search under a certain timezone?

Tags (2)
1 Solution

MuS
Legend

Hi jonahzirkle,

just had a similar problem with EST and GMT log files. We fixed it by creating a dummy user with the needed TZ settings and ran the seaved searches under this dummy user account.

You need to transfer the owner of the saved search to this dummy user either by login in as this user and create the saved searches or edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta
and change each needed occurrence to the dummy ower’s ID. Splunk needs to be restarted for these changes to take effect.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi jonahzirkle,

just had a similar problem with EST and GMT log files. We fixed it by creating a dummy user with the needed TZ settings and ran the seaved searches under this dummy user account.

You need to transfer the owner of the saved search to this dummy user either by login in as this user and create the saved searches or edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta
and change each needed occurrence to the dummy ower’s ID. Splunk needs to be restarted for these changes to take effect.

hope this helps ...

cheers, MuS

anewell
Path Finder

We're facing the same timezone spanning problem, and I had also dreamed up the the 'dummy user' solution. I was looking for evidence of prior art, so thank you for the confirmation, MuS!

0 Karma

MuS
Legend

you're welcome, please feel free to mark this as answered.

0 Karma

jonahzirkle
Engager

Thank you for the response. This and just adjusting the schedule by the hour were good workarounds. Was really hoping Splunk had an option I might've been overlooking.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...