topic Re: How do you display days in chronological order not alphabetically? in Splunk Search

How do you display days in chronological order not alphabetically?

cwhurd1 — Tue, 18 Dec 2018 17:10:01 GMT

Hi,

I am using the below search to display the average transactions by day over a couple weeks. I need the days to show in chronological order. I have seen the Splunk Documentation, and I am still not able to figure it out. Any advice will be beneficial:

index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday

Re: How do you display days in chronological order not alphabetically?

kamlesh_vaghela — Tue, 18 Dec 2018 17:50:06 GMT

@cwhurd1

Can you please try below search?

index=XXX sourcetype=XXXXX
 | timechart span=1h dc(transactionID) as transactions
 | eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday
 | rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *

My Sample Search:

index=*
 | timechart span=1h count as transactions
 | eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday | rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *

Here we know Splunk displays column name in alphabetical order, so I have provided day number as initial character of weekday and then renamed it.

thanks

Re: How do you display days in chronological order not alphabetically?

niketn — Tue, 18 Dec 2018 18:09:36 GMT

@kamlesh_vaghela this will fail if Selected Time spans across multiple weeks as stated in the question 😉

%w (Week day from 0-6) and %A (Week day from Sunday- Saturday) will match for same days of the week so they will appear next to each other.

Re: How do you display days in chronological order not alphabetically?

cwhurd1 — Tue, 18 Dec 2018 18:14:37 GMT

This did not work for me. It returned the same results.

Re: How do you display days in chronological order not alphabetically?

somesoni2 — Tue, 18 Dec 2018 19:11:03 GMT

Give this a try

 index=XXX sourcetype=XXXXX
 | timechart span=1h dc(transactionID) as transactions
 | eval weekday=strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday
| table hour Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Re: How do you display days in chronological order not alphabetically?

cwhurd1 — Tue, 18 Dec 2018 19:20:27 GMT

This worked! Thank you!