Thanks @inventsekar, I don't have or want access to the Splunk system or user files. I only have access through the Web UI. The Splunk documentation at https://docs.splunk.com/Documentation/Splunk/9.2.0/Alert/CronExpressions actually states: You can customize alert scheduling using a time range and cron expression. The Splunk cron analyzer defaults to the timezone where the search head is configured. This can be verified or changed by going to Settings > Searches, reports, and alerts > Scheduled time. But then nowhere below do they explain how to change the timezone for the cron schedule. And when I go to my alert and choose "Advanced Edit", I get a huge page with ~450 fields but nowhere the time zone. There is the field cron_schedule (and next_scheduled_time) but again, no way to change the time zone for the schedule. So I conclude, it's simply not possible.
... View more
