topic Re: Column Chart - Sorting months chronologically and not alphabetically in Splunk Search

Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 11:08:10 GMT

Morning Splunk Gurus

Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart

https://imgur.com/a/g8nor

Base Search.....
| chart count over date_month by Status

Many Thanks

Re: Column Chart - Sorting months chronologically and not alphabetically

nikita_p — Tue, 19 Dec 2017 11:43:53 GMT

Hi,
Is date included in your events?

Re: Column Chart - Sorting months chronologically and not alphabetically

nikita_p — Tue, 19 Dec 2017 11:48:27 GMT

Hi,
You can try using timechart instead of chart command
....| timechart values(status)

Re: Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 12:01:05 GMT

Thanks Nikita

I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,

When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show

date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7

Re: Column Chart - Sorting months chronologically and not alphabetically

nikita_p — Tue, 19 Dec 2017 12:08:07 GMT

Hi,
Is date_month is the field in your events?

Re: Column Chart - Sorting months chronologically and not alphabetically

nickhills — Tue, 19 Dec 2017 12:11:13 GMT

If you don't mind using date numbers instead of date names:

*|eval dateM=strftime(_time,"%m")| chart count over dateM by Status |sort -dateM

Re: Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 12:12:10 GMT

Yeah it is

Re: Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 12:15:34 GMT

Yeah that could work I guess

Re: Column Chart - Sorting months chronologically and not alphabetically

nikita_p — Tue, 19 Dec 2017 12:17:39 GMT

Also is date included in your logs?
And if good and bad are fields in your logs, you will have to do
..|timechart values(good) AS good values(bad) AS bad

Re: Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 12:30:57 GMT

So the field is "Status" and the 2 values are Good and Bad

So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc

I just want to show 3 months and each month should have a 2 bars, each bar showing a value.

Yeah I have _time and date values in logs

Thanks again

Re: Column Chart - Sorting months chronologically and not alphabetically

nickhills — Tue, 19 Dec 2017 12:47:29 GMT

in which case, this should do it
*| timechart count by status

Re: Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk — Tue, 19 Dec 2017 14:20:52 GMT

Thanks Nick
Thanks nikita