What timezone does my scheduled search run in?

[joxley]

My Splunk server is sitting in UTC and my Browser in BST (UTC+1). I have created a search that does

search terms | bucket span=1d _time | stats terms by _time and clauses | collect index=summary marker="name=summary_data"

If I run the search in the browser for the last 30 days to seed the summary index:

• What time in UTC will the search run?
• What times in UTC will bucket work on?

If I then schedule the search to run at 3am for -1d@d to @d with the same search, including the bucket:

• What time in UTC will the search run?
• What time in UTC witll bucket work on?
• Does the Run as owner/user option make any difference to the search?

[masonmorales · Accepted solution]

The search itself will always run in server time. The "scheduled time" and event timestamps will just be displayed using your selected time zone. Search commands (e.g. bucket) all work on server time as well, the presentation layer just changes it to display in your selected time zone.

Run as owner/user does not make any difference to the search time ranges.

One thing to note is that when you are doing ad hoc searches, the time picker assumes you are selecting a time range in your selected time zone,. This means that the actual time range of your search will be translated from your selected time zone to the server time zone.

[masonmorales]

BTW, I am assuming that when you say "Browser in BST (UTC+1)", that you have gone into your user preferences within Splunk and changed the time zone for your account to "BST (UTC+1)". The time zone configured on your OS isn't used by Splunk.

[ridwanahmed]

@masonmorales some clarification questions:
1. When you say search "will run in server time"-- of the Indexer or SH?
If I schedule a search to run at midnight my (SH) time, which is 5am Indexer time, looking back one hour-- I will get 4am-5am Indexer time results, right?
2. "This means that the actual time range of your search will be translated from your selected time zone to the server time zone. " So if I ask for data from the 12th hour/day/month, it will return the logs that are timestamped such on the Indexer (the actual log timestamps of 12/12 at 12oclock), right?
Thanks

[burwell]

So my experience is that the scheduled search runs in the timezone of the user. That is my experience as well.

I see another Splunk answers here where someone else said the same thing.

https://answers.splunk.com/answers/311857/cron-schedule-stuck-on-initial-user-timezone.html