Use date_hour date_minute for charting

[vtrujillo]

Hi everyone.

I'm trying to use the date_hour and date_minute fields (which reads perfectly the hours and minutes of my events from the corresponding source).

The problem is that when I perform a search, the results shows:

8/31/10
12:00:00.000 AM  event_x     * date_hour=1  date_minute=0  
8/30/10
11:55:00.000 PM  event_y     * date_hour=0  date_minute=55

And the time that Splunk uses for charting is the shown on the first column (which is wrong) instead of the hour and minute shown on the date_hour and date_minute fields (which are right).

How can I tell Splunk to use the correct time (date_hour and date_minute)?

Thanx in advance.

[Stephen_Sorkin]

date_hour and date_minute are set at index time and are based on what we extracted from the event itself. The timestamp to the left of every event is rendered from the local time of the machine running the splunk searches. To correct the rendered time, you can either change the timezone of the machine to match your expectation, or change it just for splunkd by running (on Unix platforms):

TZ=<desired timezone> splunk start

[vtrujillo]

First of all, thanks for taking the time and answer my question.
Now, that's fine but what I want to do is to build a dashboard with a line chart that uses date_hour and date_minute for rendering.
There's no way to tell Splunk to use date_hour and date_time for the time axis on the chart?
Thank you!