https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24907#M4641 <P>Hello,</P> <P>We have the following search in a chart but the dates are sorting alphabetically rather than numerically. ie Aug 1, Aug 2, Jul 29, Jul 30 and not Jul 29, Jul 30, Aug 1, Aug 2.</P> <P>index=reporter | dedup TKT_NUMBER | eval time=strftime(_time, "%b %d") | bucket time span=1d | chart count over NOTIFY_GROUP by time useother=f | rename NOTIFY_GROUP AS Group </P> Mon, 28 Sep 2020 14:30:08 GMT aaronkorn 2020-09-28T14:30:08Z https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24907#M4641 <P>Hello,</P> <P>We have the following search in a chart but the dates are sorting alphabetically rather than numerically. ie Aug 1, Aug 2, Jul 29, Jul 30 and not Jul 29, Jul 30, Aug 1, Aug 2.</P> <P>index=reporter | dedup TKT_NUMBER | eval time=strftime(_time, "%b %d") | bucket time span=1d | chart count over NOTIFY_GROUP by time useother=f | rename NOTIFY_GROUP AS Group </P> Mon, 28 Sep 2020 14:30:08 GMT https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24907#M4641 aaronkorn 2020-09-28T14:30:08Z https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24908#M4642 <P>That's because you're sorting by an alphanumeric field - Splunk doesn't know what the string you're sorting by represents. It's a better idea to sort by <CODE>_time</CODE> but have it display as something more human readable.</P> <PRE><CODE>index=reporter | dedup TKT_NUMBER | bucket _time span=1d | chart count over NOTIFY_GROUP by _time useother=f | rename NOTIFY_GROUP as GROUP | fieldformat _time=strftime(_time,"%b %d") </CODE></PRE> Mon, 05 Aug 2013 15:27:38 GMT https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24908#M4642 Ayn 2013-08-05T15:27:38Z https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24909#M4643 <P>Thanks for your response. I tried the code but still not the result I was looking for: <IMG src="http://splunk-base.splunk.com//storage/2013-08-05_1306.png" alt="alt text" /></P> Mon, 05 Aug 2013 17:07:53 GMT https://community.splunk.com/t5/Splunk-Search/date-sorting-numerically-not-alphabetically/m-p/24909#M4643 aaronkorn 2013-08-05T17:07:53Z