Splunk Search

Savedsearch next scheduled time is different from cron schedule set

Poojitha
Communicator

Hi All,

I have scheduled a splunk report to run at 11 AM IST everyday (cron schedule : 0 11 * * *). Search Head time zone is IST.

But when I checked savedsearch , the next scheduled time  is shown as 4:30 PM IST  though advance settings has 0 11 * * *.

Until yesterday it was fine . But suddenly seeing this issue. Does anyone has idea what is going wrong ?

Regards,
Poojitha NV

Labels (1)
Tags (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Poojitha 

It sounds like your search is running to 11am UTC which I believe is 16:30 IST? (UTC+5.5hr)

This is likely because the owner of the search has their timezone set to UTC - Is the search owned by your account, or a service account? Can you confirm that the account has the timezone set correctly to IST?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Poojitha
Communicator

@livehybrid  You are correct. I realised it later.

I have my SH set with timezone IST. So same I had considered and had given 11 AM as schedule. But splunk server has its timezone set in UTC. So it is considering 11 AM as UTC which is 4:30 PM IST. And so I am seeing it 🙂 Thanks for your response.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...