https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83323#M21203 <P>what if i want to use chart command instead of stats. then how do i arrange months in chronological order? <BR /> Below is the query in which i want to arrange results by chronological order: <BR /> .<BR /> .....| eval month=strftime(strptime(UpdateDate,"%m/%d/%y %H:%M"),"%B")| chart sum(Effort) by month,date_year | sort month</P> Fri, 14 Apr 2017 07:38:08 GMT lakshayanand 2017-04-14T07:38:08Z https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83319#M21199 <P>In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is displayed by alphabetic order of the month name.</P> <P>Data is displayed by alphabetic order of the month name when it should be logical.</P> <PRE><CODE>* |stats count as "Total Incident/month" by date_month </CODE></PRE> <P><IMG src="http://splunk-base.splunk.com/splunk-sort.JPG" alt="alt text" /></P> Wed, 28 Sep 2011 22:01:31 GMT https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83319#M21199 zliu 2011-09-28T22:01:31Z https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83320#M21200 <P>This is a bug. Bug#SPL-43691</P> Wed, 28 Sep 2011 22:02:37 GMT https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83320#M21200 zliu 2011-09-28T22:02:37Z https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83321#M21201 <P>This is not a bug. If you do want to sort by month, then you can place the month number in a field and sort on that, e.g.:</P> <PRE><CODE>... | eval date_numericmonth=strftime(_time,"%m") | stats count by date_numericmonth </CODE></PRE> Thu, 29 Sep 2011 03:30:13 GMT https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83321#M21201 gkanapathy 2011-09-29T03:30:13Z https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83322#M21202 <P>I would change something slightly with gkanapathy's answer. Prefix the date_numeric_month with an underscore to make it hidden and add the month name within the query.</P> <P>In this example I am getting the count of user_ids per month:</P> <P>... | eval _date_numeric_month=strftime(_time,"%m") | stats count(user_id) by _date_numeric_month, date_month | sort _date_numeric_month </P> Mon, 28 Sep 2020 10:08:12 GMT https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83322#M21202 ag 2020-09-28T10:08:12Z https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83323#M21203 <P>what if i want to use chart command instead of stats. then how do i arrange months in chronological order? <BR /> Below is the query in which i want to arrange results by chronological order: <BR /> .<BR /> .....| eval month=strftime(strptime(UpdateDate,"%m/%d/%y %H:%M"),"%B")| chart sum(Effort) by month,date_year | sort month</P> Fri, 14 Apr 2017 07:38:08 GMT https://community.splunk.com/t5/Splunk-Search/data-is-displayed-by-alphabetic-order-of-the-month-name-when/m-p/83323#M21203 lakshayanand 2017-04-14T07:38:08Z