Splunk Search

Savedsearch next scheduled time is different from cron schedule set

Poojitha
Communicator

Hi All,

I have scheduled a splunk report to run at 11 AM IST everyday (cron schedule : 0 11 * * *). Search Head time zone is IST.

But when I checked savedsearch , the next scheduled time  is shown as 4:30 PM IST  though advance settings has 0 11 * * *.

Until yesterday it was fine . But suddenly seeing this issue. Does anyone has idea what is going wrong ?

Regards,
Poojitha NV

Labels (1)
Tags (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Poojitha 

It sounds like your search is running to 11am UTC which I believe is 16:30 IST? (UTC+5.5hr)

This is likely because the owner of the search has their timezone set to UTC - Is the search owned by your account, or a service account? Can you confirm that the account has the timezone set correctly to IST?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Poojitha
Communicator

@livehybrid  You are correct. I realised it later.

I have my SH set with timezone IST. So same I had considered and had given 11 AM as schedule. But splunk server has its timezone set in UTC. So it is considering 11 AM as UTC which is 4:30 PM IST. And so I am seeing it 🙂 Thanks for your response.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...