Splunk Search

Use date_hour date_minute for charting


Hi everyone.

I'm trying to use the date_hour and date_minute fields (which reads perfectly the hours and minutes of my events from the corresponding source).

The problem is that when I perform a search, the results shows:

12:00:00.000 AM  event_x     * date_hour=1  date_minute=0  
11:55:00.000 PM  event_y     * date_hour=0  date_minute=55

And the time that Splunk uses for charting is the shown on the first column (which is wrong) instead of the hour and minute shown on the date_hour and date_minute fields (which are right).

How can I tell Splunk to use the correct time (date_hour and date_minute)?

Thanx in advance.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

date_hour and date_minute are set at index time and are based on what we extracted from the event itself. The timestamp to the left of every event is rendered from the local time of the machine running the splunk searches. To correct the rendered time, you can either change the timezone of the machine to match your expectation, or change it just for splunkd by running (on Unix platforms):

TZ=<desired timezone> splunk start


First of all, thanks for taking the time and answer my question.
Now, that's fine but what I want to do is to build a dashboard with a line chart that uses date_hour and date_minute for rendering.
There's no way to tell Splunk to use date_hour and date_time for the time axis on the chart?
Thank you!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...