https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360311#M5851 <P>It works well, thanks you</P> Fri, 29 Sep 2017 01:23:55 GMT SoknySplunk 2017-09-29T01:23:55Z https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360309#M5849 <P>Hi,<BR /> I have example of date/time as below</P> <P>Mon 28 Dec 2015 06:26:19 PM ICT<BR /> Mon 26 May 2014 04:52:02 PM ICT<BR /> Fri 17 Feb 2017 04:01:59 PM ICT<BR /> Wed 28 Jun 2017 05:49:04 PM ICT<BR /> Wed 05 Oct 2016 06:46:30 PM ICT</P> <P>I want to sort it by date, month year... in the correct order. could you please tell me how to do it.</P> Thu, 28 Sep 2017 02:31:24 GMT https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360309#M5849 SoknySplunk 2017-09-28T02:31:24Z https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360310#M5850 <P>You would have to convert the timestamp to epoch to sort it. </P> <P>Option 1 (creating a new field to sort)</P> <PRE><CODE>your current search giving above field with name say DateTime | eval sortfield=strptime(DateTime,"%a %d %b %Y %H:%M:%S %p %Z") | sort sortfield| field - sortfield </CODE></PRE> <P>Option 2 (using same field)</P> <PRE><CODE>your current search giving above field with name say DateTime | eval DateTime=strptime(DateTime,"%a %d %b %Y %H:%M:%S %p %Z") | sort DateTime| | eval DateTime=strftime(DateTime,"%a %d %b %Y %H:%M:%S %p %Z") </CODE></PRE> Thu, 28 Sep 2017 15:08:44 GMT https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360310#M5850 somesoni2 2017-09-28T15:08:44Z https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360311#M5851 <P>It works well, thanks you</P> Fri, 29 Sep 2017 01:23:55 GMT https://community.splunk.com/t5/Splunk-Dev/sorting-date-time/m-p/360311#M5851 SoknySplunk 2017-09-29T01:23:55Z