<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How can I make the months appear in alphabetical order without interfering with my chart legend in a stacked bar chart? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413881#M27206</link>
    <description>&lt;P&gt;I want to preserve the logic, columns, and legend of the chart produced by my query but with months in chronological order rather than alphabetical. The solutions I found on here for correcting the month order seem to change the values used for my legend.&lt;/P&gt;

&lt;P&gt;How can I make the months appear in alphabetical order without interfering with my chart legend?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|`init("xxx")`
| where strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;gt;now() AND strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;lt;=relative_time(now(), "+6mon")
| eval month=strftime(strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N"),"%b")
| table info_subType info_date_reported month
| chart count(info_subType) over month by info_subType
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 21 May 2018 23:59:42 GMT</pubDate>
    <dc:creator>rkassabov</dc:creator>
    <dc:date>2018-05-21T23:59:42Z</dc:date>
    <item>
      <title>How can I make the months appear in alphabetical order without interfering with my chart legend in a stacked bar chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413881#M27206</link>
      <description>&lt;P&gt;I want to preserve the logic, columns, and legend of the chart produced by my query but with months in chronological order rather than alphabetical. The solutions I found on here for correcting the month order seem to change the values used for my legend.&lt;/P&gt;

&lt;P&gt;How can I make the months appear in alphabetical order without interfering with my chart legend?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|`init("xxx")`
| where strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;gt;now() AND strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;lt;=relative_time(now(), "+6mon")
| eval month=strftime(strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N"),"%b")
| table info_subType info_date_reported month
| chart count(info_subType) over month by info_subType
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 21 May 2018 23:59:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413881#M27206</guid>
      <dc:creator>rkassabov</dc:creator>
      <dc:date>2018-05-21T23:59:42Z</dc:date>
    </item>
    <item>
      <title>Re: How can I make the months appear in alphabetical order without interfering with my chart legend in a stacked bar chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413882#M27207</link>
      <description>&lt;P&gt;Try this - if it does nto work, then continue as below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; |`init("xxx")`
 | where strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;gt;now() 
    AND strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N")&amp;lt;=relative_time(now(), "+6mon")
 | eval month = relative_time(strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N"),"@mon")
 | fields month info_subType
 | fieldformat month=strftime(month,"%b")
 | chart count over month by info_subType
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;HR /&gt;

&lt;P&gt;If the above does not work...&lt;/P&gt;

&lt;P&gt;ISO date format is YYYY-MM-DD.  This way it is unambiguous, and can be sorted and compared directly without conversion.&lt;/P&gt;

&lt;P&gt;If you really need the month written out, and if &lt;CODE&gt;fieldformat&lt;/CODE&gt; does not work for &lt;CODE&gt;chart&lt;/CODE&gt; then put the numeric  year and month on the front of the formatted date first, like this:&lt;/P&gt;

&lt;P&gt;2) &lt;CODE&gt;| eval month=strftime(strptime(info_date_reported,"%Y-%m-%d %H:%M:%S.%6N"),""%Y-%m %b")&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 22 May 2018 02:45:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413882#M27207</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2018-05-22T02:45:33Z</dc:date>
    </item>
    <item>
      <title>Re: How can I make the months appear in alphabetical order without interfering with my chart legend in a stacked bar chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413883#M27208</link>
      <description>&lt;P&gt;The first one worked perfectly, thanks!&lt;/P&gt;</description>
      <pubDate>Tue, 22 May 2018 02:54:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-make-the-months-appear-in-alphabetical-order-without/m-p/413883#M27208</guid>
      <dc:creator>rkassabov</dc:creator>
      <dc:date>2018-05-22T02:54:43Z</dc:date>
    </item>
  </channel>
</rss>

