Savedsearch next scheduled time is different from cron schedule set

[Poojitha]

Hi All,

I have scheduled a splunk report to run at 11 AM IST everyday (cron schedule : 0 11 * * *). Search Head time zone is IST.

But when I checked savedsearch , the next scheduled time  is shown as 4:30 PM IST  though advance settings has 0 11 * * *.

Until yesterday it was fine . But suddenly seeing this issue. Does anyone has idea what is going wrong ?

Regards,
Poojitha NV

[livehybrid]

Hi @Poojitha 

It sounds like your search is running to 11am UTC which I believe is 16:30 IST? (UTC+5.5hr)

This is likely because the owner of the search has their timezone set to UTC - Is the search owned by your account, or a service account? Can you confirm that the account has the timezone set correctly to IST?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Poojitha]

@livehybrid  You are correct. I realised it later.

I have my SH set with timezone IST. So same I had considered and had given 11 AM as schedule. But splunk server has its timezone set in UTC. So it is considering 11 AM as UTC which is 4:30 PM IST. And so I am seeing it 🙂 Thanks for your response.