https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355179#M105079 <P>Can you post some example data?<BR /> What format are the values in?</P> Thu, 21 Dec 2017 10:32:45 GMT nickhills 2017-12-21T10:32:45Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355178#M105078 <P>I have on field named average duration which is right now sorting alphabetically.<BR /> Are there any way we can sort it by month,day ,hours and minutes then in numerical order??</P> Thu, 21 Dec 2017 10:20:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355178#M105078 chitreshakumar 2017-12-21T10:20:08Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355179#M105079 <P>Can you post some example data?<BR /> What format are the values in?</P> Thu, 21 Dec 2017 10:32:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355179#M105079 nickhills 2017-12-21T10:32:45Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355180#M105080 <P>Name Average duration<BR /> X 1.4 hrs<BR /> Y 6.2 minutes<BR /> Z 2.9 days <BR /> XY 20 days<BR /> YZ 22minutes<BR /> A 1.2 months</P> <P>Something like this.Since its confidential so can't post the original .SO sample one I am posting</P> Thu, 21 Dec 2017 10:35:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355180#M105080 chitreshakumar 2017-12-21T10:35:49Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355181#M105081 <P>Try this:</P> <PRE><CODE> | eval month_num=strftime(_time,"%m") | eval Month=date_mday."-".date_month."-".date_year."-".date_hour.":".date_minute | stats count by month_num,Month date_hour date_mday date_minute | sort - limit=0 month_num date_mday date_hour date_minute </CODE></PRE> Thu, 21 Dec 2017 10:42:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355181#M105081 mayurr98 2017-12-21T10:42:07Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355182#M105082 <P>Thanks for your reply!!<BR /> But there is only one field that is having the average count for every person .I want a logic for that kind of sorting.</P> Thu, 21 Dec 2017 10:45:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355182#M105082 chitreshakumar 2017-12-21T10:45:36Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355183#M105083 <P>hmm... yuk!</P> <P>probably just a formatting error - but can you confirm there is always a space between the number and the unit.<BR /> Also, is it hrs, or hours?</P> Thu, 21 Dec 2017 10:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355183#M105083 nickhills 2017-12-21T10:48:07Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355184#M105084 <P>this is your input data right?<BR /> and what output you want?</P> Thu, 21 Dec 2017 10:49:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355184#M105084 mayurr98 2017-12-21T10:49:26Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355185#M105085 <P>Try this!</P> <PRE><CODE>&lt;your search&gt;|table Name "Average duration" |rex field="Average duration" "(?&lt;val&gt;\d+\.?\d+)\s(?&lt;unit&gt;\w+)" |evalmultiplier=case(unit=="seconds",1,unit="minutes",60,unit=="hrs",3600,unit=="days",86400,unit="months",2592000) |eval durseconds=(val*multiplier) |sort -durseconds|fields Name "Average duration" </CODE></PRE> Thu, 21 Dec 2017 11:00:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355185#M105085 nickhills 2017-12-21T11:00:38Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355186#M105086 <P>This is the input .I want output like .<BR /> While ascending<BR /> Y 6.2 minutes<BR /> YZ 22minutes<BR /> X 1.4 hrs<BR /> Z 2.9 days <BR /> XY 20 days<BR /> A 1.2 months</P> <P>Descending <BR /> A 1.2 months<BR /> XY 20 days<BR /> Z 2.9 days <BR /> X 1.4 hrs<BR /> YZ 22minutes<BR /> Y 6.2 minutes</P> Thu, 21 Dec 2017 11:16:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-the-average-time/m-p/355186#M105086 chitreshakumar 2017-12-21T11:16:03Z