https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370776#M162089 <P>My recommendation is to not convert the <CODE>_time</CODE> field with an eval but instead to use the command <CODE>fieldformat</CODE> to change how the value is displayed while retaining the original epoch string, which is easily sortable. That search would look like this:</P> <PRE><CODE>your base search that filters down to events in the desired time range | bucket _time span=1h | stats count(id) as "Unsuccessful Logins" by _time | sort _time | fieldformat _time=strftime(_time, "%b %d, %Y %I:%M:%S %p") </CODE></PRE> Wed, 21 Mar 2018 18:12:41 GMT elliotproebstel 2018-03-21T18:12:41Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370775#M162088 <P>Hi,</P> <P>I have a result table with two columns "formattedTime" and "Unsuccessful logins". I am displaying time in the format like " eval formattedTime = strftime(_time, "%b %d, %Y %I:%M:%S %p") ". I see the following result in the output:</P> <P>formattedTime Unsuccessful Logins<BR /> Mar 20, 2018 01:00:00 AM 1799<BR /> Mar 20, 2018 01:00:00 PM 3741<BR /> Mar 20, 2018 02:00:00 AM 1785<BR /> Mar 20, 2018 02:00:00 PM 3703<BR /> Mar 20, 2018 03:00:00 AM 1694<BR /> Mar 20, 2018 03:00:00 PM 3651<BR /> Mar 20, 2018 04:00:00 AM 1764<BR /> Mar 20, 2018 04:00:00 PM 3683<BR /> Mar 20, 2018 05:00:00 AM 2515</P> <P>What I need is to display the results from 12 AM - 4 PM is ascending format.</P> <P>This is the current logic I am using to display those results: </P> <P>| bucket _time span=1h | eval formattedTime = strftime(_time, "%b %d, %Y %I:%M:%S %p") |stats count(id) as "Unsuccessful Logins" by formattedTime| sort formattedTime</P> <P>Any one please help me!</P> <P>Thanks in advance. </P> Tue, 29 Sep 2020 18:37:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370775#M162088 rakeshyv0807 2020-09-29T18:37:04Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370776#M162089 <P>My recommendation is to not convert the <CODE>_time</CODE> field with an eval but instead to use the command <CODE>fieldformat</CODE> to change how the value is displayed while retaining the original epoch string, which is easily sortable. That search would look like this:</P> <PRE><CODE>your base search that filters down to events in the desired time range | bucket _time span=1h | stats count(id) as "Unsuccessful Logins" by _time | sort _time | fieldformat _time=strftime(_time, "%b %d, %Y %I:%M:%S %p") </CODE></PRE> Wed, 21 Mar 2018 18:12:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370776#M162089 elliotproebstel 2018-03-21T18:12:41Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370777#M162090 <P>@elliotproebstel - Thank you for the suggestion. It worked as expected.</P> Wed, 21 Mar 2018 19:57:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-using-formatted-time/m-p/370777#M162090 rakeshyv0807 2018-03-21T19:57:29Z