Knowledge Management

Unable to schedule PDF delivery with correct time zone

bensec01
Explorer

Hey folks,

 

   I have what I believed would be a simple question, but it's turning out to be more of a challenge than expected.  This is on-prem Splunk Enterprise v7.2.4.2.

 

   I have a view.  I've scheduled PDF delivery of that view each morning.  It works like a champ.  However, the time presented in the resulting PDF is in UTC (which is what the sending Splunk search head runs under).  OK, fine, so I added 'dispatchAs = owner' to the savedsearches.conf entry for the PDF delivery, and made sure that the view has 'owner = <my username>' in metadata/local.meta.  I've read and re-read the spec for savedsearches.conf, and I believe I'm interpreting it correctly.

 

   Incidentally, when loading the view in the Splunk web UI as the same username from above, I get the correct times (adjusted for the local time zone).

 

   However, the PDF continues to arrive using UTC (we're in Central time zone and everything is 6 hours off in the PDF).  I don't know what I'm missing, this really doesn't seem to be that hard.  I *think* I'm reading the docs correctly.

 

   I would very much appreciate any hints, pointers, or clue-by-fours.  Thank you so much!

 

Chris

 

Labels (2)
0 Karma

bensec01
Explorer

Ping?

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>