topic Sorting of Fields base on Timestamp in Dashboards & Visualizations

Sorting of Fields base on Timestamp

Zyon — Mon, 26 Aug 2013 14:16:16 GMT

Hello!

Im trying to sort a field based on the timestamp.

This is my current search command

sourcetype=log | eval date_readable=date_mday." ".date_month | stats count by date_readable

Using this search command, I'm able to produce the following graph in my dashboard.
Graph: http://i40.tinypic.com/2ai0zzn.png

However, the date is not sort in a correct sequence. Is there anyway for me to sort the date_readable field according to timestamp?

Thanks!

Re: Sorting of Fields base on Timestamp

kristian_kolb — Mon, 26 Aug 2013 14:43:38 GMT

Well, from what it looks like in the picture, it is sorted on date_readable. Unfortunately for you, date_readable has no special meaning to Splunk - it's just a string.

I'd suggest that you do the following instead;

sourcetype=log | timechart span=1d count

That will sort it automatically.

UPDATE:

linu1988 has a point here - there is a difference between _time and the date_* fields. In your original search query, you used the date_* fields, but the timechart approach I suggested uses _time.

See lguinns excellent explanation here;

http://answers.splunk.com/answers/99451/variance-betweeen-time-and-date-fields

Re: Sorting of Fields base on Timestamp

linu1988 — Mon, 26 Aug 2013 14:56:09 GMT

because it's still a string not a date.

Convert into time using strftime()/ convert then do a sort then chart...

Re: Sorting of Fields base on Timestamp

linu1988 — Mon, 26 Aug 2013 14:57:12 GMT

If the eventtime is matching with the log time, if not _time needs to assigned from logs then chart...

Re: Sorting of Fields base on Timestamp

Zyon — Mon, 26 Aug 2013 15:00:39 GMT

sourcetype=log | timechart span=1d count works for me! Thanks a lot! (: