topic Re: Sort by time in a chart with time header names in Splunk Search

Sort by time in a chart with time header names

dojiepreji — Fri, 10 May 2019 08:48:44 GMT

Hi,

I have a search table that aims to show the inflow of tickets for a time range.

Here is what it looks like...

Hour     |     Apr-18     |     Apr-19     |     Aug-18     |     Dec-18
0:00              2                 3               5                3 
1:00              2                13               2                1

Here is the search for this table...

index=_internal
| bin _time span=1h 
| eval hour = strftime(_time, "%H:%M") 
| eval monthYear = strftime(_time, "%b-%y") 
| stats count(ticketNumber) as inflow values(hour) as hour values(monthYear) as monthYear by _time 
| chart limit=0 sum(inflow) as inflow over hour by monthYear

I want to sort my columns by date, (Apr-18, Aug-18, Dec-18, Apr-19). I cannot use "fields ..." because the user is free to input the time range that the table will display.

Any help would be appreciated. Thank you.

Re: Sort by time in a chart with time header names

vnravikumar — Fri, 10 May 2019 08:56:12 GMT

Check this link

https://answers.splunk.com/answers/294224/how-to-sort-column-chart-based-on-month-year-order.html

Re: Sort by time in a chart with time header names

dojiepreji — Fri, 10 May 2019 09:30:19 GMT

I solved it by appending a "-01" on monthYear and then transposing the chart.

index=_internal
| timechart span=1h count 
| eval hour = strftime(_time, "%H:%M") 
| eval monthYear = strftime(_time, "%b-%y") 
| chart limit=0 sum(count) as inflow over monthYear by hour 
| eval dateSort = monthYear . "-1" 
| eval dateSortEpoch = strptime(dateSort, "%b-%y-%d") 
| sort dateSortEpoch 
| transpose 0 column_name="Time" header_field="monthYear" 
| search NOT Time = "date*"