Knowledge Management

Unable to schedule PDF delivery with correct time zone


Hey folks,


   I have what I believed would be a simple question, but it's turning out to be more of a challenge than expected.  This is on-prem Splunk Enterprise v7.2.4.2.


   I have a view.  I've scheduled PDF delivery of that view each morning.  It works like a champ.  However, the time presented in the resulting PDF is in UTC (which is what the sending Splunk search head runs under).  OK, fine, so I added 'dispatchAs = owner' to the savedsearches.conf entry for the PDF delivery, and made sure that the view has 'owner = <my username>' in metadata/local.meta.  I've read and re-read the spec for savedsearches.conf, and I believe I'm interpreting it correctly.


   Incidentally, when loading the view in the Splunk web UI as the same username from above, I get the correct times (adjusted for the local time zone).


   However, the PDF continues to arrive using UTC (we're in Central time zone and everything is 6 hours off in the PDF).  I don't know what I'm missing, this really doesn't seem to be that hard.  I *think* I'm reading the docs correctly.


   I would very much appreciate any hints, pointers, or clue-by-fours.  Thank you so much!




Labels (2)
0 Karma




0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out &gt;&gt; Kudos to all the ...