Splunk

[Priya70]

n/a

[Priya70]

N.A

[isoutamo]

This should works correctly.
When you are saying “restart UF”, are you meaning splunk UF process or whole windows node?
Any reason why you are using separate ntpd instead of domain time? Have you checked how big time difference is after hibernation? You are aware that there are limits how big time difference ntpd can manage by itself without additional synchronization?

[Priya70]

N.A

[isoutamo]

How quickly that sw update node’s time to correct after hibernation? Basically after that UF’s cron schedule should work as expected. If not then I propose that you should create a support case to Splunk.

[Priya70]

N.A

[isoutamo]

So UF recognize the change of time when it writes this message into log, but its scheduler didn’t understand it correctly to run next round at correct time. Definitely time to create splunk support case.

[Priya70]

N/A

[isoutamo]

Can you paste your inputs.conf here between editor's script block </> ?

When you are saying "cheduled runs are sometimes missed, or scripts execute at unexpected times." is the only fix for this to restart splunkd service on UF?

Are those UFs in domain or just individual nodes which manages time sync with ntpd instead of Windows domain service?