topic Reporting / Dashboard issues in Dashboards & Visualizations

Reporting / Dashboard issues

magneto417x — Tue, 29 Sep 2020 13:09:56 GMT

So I am using the following search to grab data:

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | streamstats avg(daycount) |

Issue I noticed today when looking at month to date it orders result in below order which also messes up bar chart any suggestions to fix would be much appreciated.

1
10
2
3
4
5
6
7
8
9

Re: Reporting / Dashboard issues

somesoni2 — Fri, 10 Mar 2017 15:44:05 GMT

Try like this

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | sort 0 num(date_mday) | streamstats avg(daycount)

Re: Reporting / Dashboard issues

rjthibod — Fri, 10 Mar 2017 15:49:17 GMT

Quick note, I am not entirely sure what you are doing with the eval Time ... step because that doesn't have any effect.

Regadless, you can fix your sorting problem by adding a leading zero to date_mday. Add this to your search for ascending calendar dates..

| eval date_mday = if(date_mday < 10, "0".tostring(date_mday), tostring(date_mday)) | sort +date_mday

Re: Reporting / Dashboard issues

magneto417x — Fri, 10 Mar 2017 15:49:22 GMT

The returns same results and still not in order 😞

Re: Reporting / Dashboard issues

somesoni2 — Fri, 10 Mar 2017 16:11:02 GMT

That works for me for similar query. Did you use the exact query I gave or there was any modification. Give @rjthibod's answer a try then.

Re: Reporting / Dashboard issues

puneethgowda — Fri, 10 Mar 2017 16:21:18 GMT

eval Time=strftime(_time,"%b %Y")

You are not using eval for any results.

My suggestion is to make use of strftime

Like below

eval datemday=strftime(_time,????)

Give the required format

And count by datemday

You can also use raw date column instead of _tim because daylight matters

Re: Reporting / Dashboard issues

magneto417x — Fri, 10 Mar 2017 16:35:49 GMT

I'm not sure I understand that would make my search be then I tried it a few times and it fails. Would you be able to post what the complete statement would look like?

Re: Reporting / Dashboard issues

magneto417x — Fri, 10 Mar 2017 16:38:00 GMT

Copied the query and ran it and it failed 😞

Re: Reporting / Dashboard issues

rjthibod — Fri, 10 Mar 2017 16:47:55 GMT

@magneto417X Did you try my suggestion of prepending the 0 to some dates?

Re: Reporting / Dashboard issues

magneto417x — Fri, 10 Mar 2017 16:54:53 GMT

Not yet had to go to a meeting but plan to give it a spin when I'm back. I will try and update thread 🙂

Re: Reporting / Dashboard issues

magneto417x — Fri, 10 Mar 2017 18:10:51 GMT

That worked. Thanks 🙂

Re: Reporting / Dashboard issues

puneethgowda — Fri, 10 Mar 2017 18:13:50 GMT

Sleeping time in India now let me try tomorrow