topic Re: How do I sort my search events by week? in Splunk Search

How do I sort my search events by week?

ronniemakhombi — Mon, 17 Dec 2018 09:32:33 GMT

I am new to Splunk. I am having a problem sorting my search results by week. I tried using the following dates as my earliest and latest dates as:

| earliest="08/06/2018" latest="30/06/2018"

The following is a snippet for my events.

DATE,Number,Count,Amount
08/06/2018,267774,1,5
08/06/2018,267721,1,5
30/06/2018,2677759,1,5

Please help

Re: How do I sort my search events by week?

renjith_nair — Mon, 17 Dec 2018 09:50:57 GMT

@ronniemakhombi,

Try using the week number in the sorting

your search|eval week_no=strftime( strptime(DATE,"%d/%m/%Y"),"%V")|sort week_no

Re: How do I sort my search events by week?

ronniemakhombi — Mon, 17 Dec 2018 10:28:33 GMT

Hi
renjith, Kindly explain ( strptime(DATE,"%d/%m/%Y"),"%V"). i used it as | eval week_1=strftime( strptime(DATE,"08/06/2018"),"%V")

Re: How do I sort my search events by week?

renjith_nair — Mon, 17 Dec 2018 10:35:16 GMT

strptime(DATE,"%d/%m/%Y") converts your DATE to an epoch time. Lets assume the field as e
strftime(e,"%V") extracts the week number from that.

So it can be splitted into two steps as well

|eval time_in_epoch=strptime(DATE,"%d/%m/%Y")
|eval week_1=strftime(time_in_epoch,"%V")

Hope that helps

Re: How do I sort my search events by week?

ronniemakhombi — Tue, 29 Sep 2020 22:29:17 GMT

It worked thanx! It grouped my search results into 4. For the future, using

|eval time_in_epoch=strptime(DATE,"%d/%m/%Y")
|eval week_1=strftime(time_in_epoch,"%V")

How can I have the results displaying week 1, week 2, week 3 and week 4.

Re: How do I sort my search events by week?

renjith_nair — Mon, 17 Dec 2018 12:39:38 GMT

Hows your output looks like now? Are there only 4 rows and the count is per week and sorted?

Re: How do I sort my search events by week?

ronniemakhombi — Tue, 29 Sep 2020 22:24:53 GMT

Hi Renjith. The following is the output I received from

|eval time_in_epoch=strptime(DATE,"%d/%m/%Y")
|eval week_1=strftime(time_in_epoch,"%V")

I want to sort them as Week 1, Week 2, Week 3, Week 4

Re: How do I sort my search events by week?

ronniemakhombi — Mon, 17 Dec 2018 14:16:04 GMT

There are 4 rows and the count. These rows are as 23, 24, 25, 26 (These are not sorted), however, the count is sorted.

Re: How do I sort my search events by week?

renjith_nair — Mon, 17 Dec 2018 14:24:22 GMT

@ronniemakhombi,
Alright.
Try

"your current search"|sort week_1|streamstats count as _rowno|eval week_1="Week"._rowno