Why Splunk Cloud 6.2 cron scheduled jobs trigger at different times than expected?

[chatterjb]

I'm not exactly sure what happened in the update of 6.2 for splunk cloud, but for some reason all of our cron jobs are running off.

0 12,17 * * * this job is to run at 12 noon and 5 pm each day. It was working fine for a while, but after 12/12/14 it suddenly started coming in at 7AM and 12 noon. Was there an update to splunk's internal clock or to cron jobs?

Edit: So I was looking into all of the alerts/reports that I scheduled, it seems all of them shifted back 6 hours . . . So what once ran from 10-21 now runs from 4-15

[yannK · Accepted solution]

Known bug in 6.2.0

SPL-92736 Scheduler ignores user/owner user_pref time zone setting for cron scheduled searches, runs cron scheduled search in relation to system time.

http://docs.splunk.com/Documentation/Splunk/6.2.0/ReleaseNotes/Knownissues#Search.2C_saved_search.2C...

[sc0tt]

Is there any update on this? We've just upgraded to version Splunk 6.2 and all of our jobs are executing off schedule.

[chrisshazammerm]

The SPL-92736 issue no longer exists in 6.2.2 (according to the documentation).

[yannK]

No updates, still a bug on 6.2.1, see http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/KnownIssues#Search.2C_saved_search.2C...

Wait for the next patch version 6.2.2 to get the fix

[bmacias84]

This could be because of the zone the Splunk Cloud instance is in or set to. If the system is set to UTC and you are in Central Time Zone that would account for the 6 hour difference.

[chatterjb]

@bmacia84 I don't have direct access to the splunk folder since it's the cloud version (or I don't know exactly how to get to it). But I did run this query index=_internal source=*scheduler.log to grab the records and it is showing that everything run as instructed just not at the right time. Also I would have expected to get double emails since I email on the scheduled task.

[bmacias84]

I would try using $SPUNK_HOME/bin/splunk cmd btool --debug savedsearches list. It possible that you have two saved searches running on different schedules outputting the data twice on two different intervals. The following command will output savedsearched stanza with what app running them