topic Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work in Splunk Search

Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

zd00191 — Fri, 31 Jul 2015 01:37:39 GMT

I have the following search that creates a bar chart with the days of the week on the vertical axis. THe days are in alphabetical order and I need them to be in order of the week to date so Sunday Monday tuesday wednesday thursday friday.

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" JOB_NAME="*" job_status=SUCCESS OR job_status=FAILURE OR job_status=RESTART OR job_status="TERMINATED" |stats count(JOB_NAME) as "Number of Jobs" by date_wday,job_status |eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field |xyseries date_wday,job_status,"Number of Jobs"

Please help! Thanks!

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

woodcock — Fri, 31 Jul 2015 02:03:08 GMT

Try this:

index=ko_autosys AND sourcetype=autosys_applog_scheduler_events AND JOB_NAME="*"
AND (host="usatlb98" OR host="usatlb91") 
AND (job_status="SUCCESS" OR job_status="FAILURE" OR job_status="RESTART" OR job_status="TERMINATED")
| stats count(JOB_NAME) as "Number of Jobs" BY date_wday job_status
| xyseries date_wday,job_status,"Number of Jobs"
| eval sort_field = case(date_wday=="monday",    1,
                         date_wday=="tuesday",   2,
                         date_wday=="wednesday", 3,
                         date_wday=="thursday",  4,
                         date_wday=="friday",    5,
                         date_wday=="saturday",  6,
                         date_wday=="sunday",    7)
| sort 0 sort_field
| fields - sort_field

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

aschneps — Tue, 29 Sep 2020 07:59:03 GMT

Hi all,

for me and my needs a simpler way worked fine for me, just in regards or sorting Monday - Sunday in the order I like

Try this:

...|chart count(yourfiled) by date_hour date_wday | table date_hour, monday, thuesday,wednesday,thursday,friday,saturday,sunday | sort date_hour

Hope this helps everyone targeting the same problem.

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

gavinliston — Mon, 15 Jan 2018 17:13:29 GMT

I downvoted this post because did not work

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

bgstein — Fri, 28 Sep 2018 18:55:52 GMT

Worked for me and gave me just what I wanted. Thanks! Albeit for a simpler search.