Getting Data In

Cronjob schedule different timezone than default system time for savedsearches

Splunker2024
New Member

I ran a |REST search to export the list of savedsearches along with their cronjob schedules.  The cronjob scheduled are not showing the time in UTC time.

ex | REST output for a search shows cronjob of 10 14 * * *,  but when I look at the REPORT tab on the SHC and see the list of saved searches, the "Next Scheduled Time" column shows 2024-04-07 18:10:00 UTC

My SHC and deployers splunk servers are both set to UTC as the default system time.  On the SHC UI, when I log in, my preferences are also set to view data in "default system time".  I am physically located in an Eastern Time Zone.

I am trying to see how to fix this so the |REST output of saved searches and their cronjob schedule is in UTC.


Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try changing your user preferences to show times explicitly in UTC.  If the cron time changes to "10 18 * * *" then the system timestamp is Americas/New_York rather than UTC.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...