HI Thanks for your help. I have created this file however when i log in from DUBLIN with two users Admin = Default Time Zone Consultant = Paris Time Zone I still get the issues that after i do an action in my GUI it acts differently to when i log in Via CITRIX from PARIS. ... View more

,HI , I would like to schedule Cron Job that has period from 6pm of first day to 4 am of second day. I have checked multiple splunk documentations and blogs but couldn't able to find right way to do it. it looks like it takes with in 0-23 hrs of single day.Could some one help with this? ... View more

You must do this with datetime.xml ; but you must NEVER edit the existing global file! You need to create your own, put an entry in your own app's props.conf (again, not the global one) file, like this: DATETIME_CONFIG = /etc/apps/MyApp/default/datetime.xml It should have something like this: <datetime> <define name="myappdatetimefromfile" extract="year, month, day"> <text><![CDATA[source::.*?-(\d{2})(0\d|1[012])([012]\d|3[01])-\d{2}_\d{2}]]></text> </define> <timePatterns> <use name="myappdatetimefromfile"/> </timePatterns> <datePatterns> <use name="myappdatetimefromfile"/> </datePatterns> </datetime> ... View more

You can short-circuit the job during the blackout period by using addinfo and map for the blackout period that it is not supposed to run like this (extra steps for clarity): | noop | stats count AS myHourMin | addinfo | eval myHourMin=tonumber(strftime(now(), "%H%M")) | eval blackout= if((myHourMin>2100),"YES","NO") | eval earliestMaybe=if((blackout=="NO"), info_min_time, now()) | map search="search earliest=$earliestMaybe$ latest=$info_max_time$ YOUR SEARCH HERE" For the time range that it is not supposed to run, the search will generate an error. Here are other similar questions with answers that should work for you (this answer is derived from the first one): http://answers.splunk.com/answering/260370/view.html http://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html ... View more