topic timestamp in Getting Data In

timestamp

lorscardala985 — Thu, 03 Aug 2023 09:05:20 GMT

i have a problem with the timestamp when i parsing the data, i want the date to start with 28/04/2023 and end with 03/05/2023 but it start with 30/04 then 29/04 and end with 28/04, who can i start the data with 28/04 and not 30/04

Re: timestamp

ITWhisperer — Thu, 03 Aug 2023 09:09:23 GMT

It sounds like the timerange for your search is not correct - how are you setting this?

Also, event usually come back in reverse chronological order (latest first). You can reverse the order with the reverse command or sort command (using _time as the sort variable).

Re: timestamp

gcusello — Thu, 03 Aug 2023 09:28:45 GMT

Hi @lorscardala985 ,

are you speaking of the parsing phase or the search outputs ?

if in the parsing phase, the date is extracted from the log so there isn't a starting or ending date.

If you're speaking of the search output, you can change the sorting order using the sort command:

<your_search> | sort _time | table ...

Ciao.

Giuseppe

Re: timestamp

lorscardala985 — Thu, 03 Aug 2023 09:29:05 GMT

this are my sourcetype and the problem with the date

Re: timestamp

ITWhisperer — Thu, 03 Aug 2023 09:49:36 GMT

This issue doesn't appear to be with the dates per se, it is that the x-axis is sorted lexicographically (alphabetically) - either change your date format to YYYY/MM/DD or change the search so that the results are sorted by ascend time order.