topic Re: splunk dash board in Dashboards & Visualizations

How to sort by date mm-dd-yy

dinuManick — Thu, 16 Nov 2023 11:16:48 GMT

For my dashboard, I am using the following regex. Although the current date is displayed at the end of the dashboard and the oldest date is displayed at the top, I require the date format to be mm-dd-yy only. My dashboard should show the most recent date at the top. Give me your finest recommendations, please.

| eval date=strftime(_time, "%m-%d-%y") | stats count by date,

Re: splunk dash board

ITWhisperer — Thu, 16 Nov 2023 11:13:55 GMT

Format your time after stats and sorting

| bin _time span=1d | stats count by _time | sort 0 - _time | fieldformat _time=strftime(_time,"%m-%d-%y")

Re: splunk dash board

isoutamo — Thu, 16 Nov 2023 11:14:59 GMT

here is one way to do it

| eval date=strftime(_time,"%m-%d-%y"), date_s = strftime(_time, "%Y%m%d") | stats count values(date) as date by date_s | sort 0 - date_s | table date count

You are needing a field which is numeric and can sorted by your wanted way.

r. Ismo

Re: How to sort by date mm-dd-yy

PickleRick — Thu, 16 Nov 2023 12:26:29 GMT

Manipulating date in string format is counter-productive. Either render your date to string at the very end of your pipeline or (even better) use fieldformat to display the field in string format but keep it in numerical form so it's easier to deal with.

Re: splunk dash board

dinuManick — Thu, 16 Nov 2023 13:04:14 GMT

Super , This is functioning, however the column is shifting. But thank you, I now have a solution.

Re: splunk dash board

dinuManick — Thu, 16 Nov 2023 13:06:18 GMT

Fantastic, many thanks This appears simple, and my output hasn't changed, i got latest date in top of the table now . Thank you