https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187351#M53975 <P>sorry it's kind of messy, but here it is: </P> <P>source=<EM>Ipc.Recon.Web</EM> <EM>New merchant. Redirecting to SWC. ServiceKey: 1846869E3691300C, AppPid: 0F4633D95001300C</EM> NOT M66128 | dedup MPID | chart count AS auth.net BY date_wday | appendcols [search source=<EM>Ipc.Sync.Web</EM> <EM>New merchant. Redirecting to SWC. ServiceKey: 970A36376A11300C, AppPid: A476DC90C001300C</EM> | dedup MPID | chart count AS clover BY date_wday ]</P> Mon, 28 Sep 2020 17:21:49 GMT halkelley 2020-09-28T17:21:49Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187347#M53971 <P>can I chart data by day of the week, but have it come out chronologically instead of alphabetically?.. i.e. I want Sunday, Monday, Tuesday... instead of Friday, Monday, Saturday...</P> Tue, 19 Aug 2014 16:34:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187347#M53971 halkelley 2014-08-19T16:34:04Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187348#M53972 <P>Hi @halkelley</P> <P>Have you tried using the timechart command?<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Timechart</A></P> Tue, 19 Aug 2014 17:09:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187348#M53972 ppablo 2014-08-19T17:09:15Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187349#M53973 <P>yeah, the problem is I'm grouping all data into day of the week bins, so I have Sunday = cumulative data for every Sunday, etc.</P> Tue, 19 Aug 2014 17:11:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187349#M53973 halkelley 2014-08-19T17:11:45Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187350#M53974 <P>@halkelley </P> <P>Would you be able to paste your current search you're using? This will make it easier for search experts to help figure out your issue and work from there <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 19 Aug 2014 17:17:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187350#M53974 ppablo 2014-08-19T17:17:42Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187351#M53975 <P>sorry it's kind of messy, but here it is: </P> <P>source=<EM>Ipc.Recon.Web</EM> <EM>New merchant. Redirecting to SWC. ServiceKey: 1846869E3691300C, AppPid: 0F4633D95001300C</EM> NOT M66128 | dedup MPID | chart count AS auth.net BY date_wday | appendcols [search source=<EM>Ipc.Sync.Web</EM> <EM>New merchant. Redirecting to SWC. ServiceKey: 970A36376A11300C, AppPid: A476DC90C001300C</EM> | dedup MPID | chart count AS clover BY date_wday ]</P> Mon, 28 Sep 2020 17:21:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187351#M53975 halkelley 2020-09-28T17:21:49Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187352#M53976 <P>it just seems if you chart By date_wday, you would want it to come out sunday, monday, tuesday, etc., and not the days alphabetically</P> Tue, 19 Aug 2014 17:33:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187352#M53976 halkelley 2014-08-19T17:33:18Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187353#M53977 <P>I think this is not the cleanest wat, but this should work. Have a CSV lookup for date_wday to day_number. After chart, do the lookup then the result will be 3 columns. Sort based on day_number and then ignore the day_number. </P> <P>I will be eager to know if there is any clean way to get this done</P> Mon, 28 Sep 2020 17:21:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187353#M53977 strive 2020-09-28T17:21:56Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187354#M53978 <P>@strive Thanks for chiming in. I was hoping you or another search guru would take a stab at it <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span> I definitely want to learn from the different solutions to this.</P> Tue, 19 Aug 2014 18:10:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187354#M53978 ppablo 2014-08-19T18:10:47Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187355#M53979 <P>@strive that worked!...thanks very much...a lot better than prefixing a 0-6 in front of every weekday name!</P> Tue, 19 Aug 2014 19:03:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187355#M53979 halkelley 2014-08-19T19:03:27Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187356#M53980 <P>May be like this (without lookups)</P> <PRE><CODE>source=Ipc.Recon.Web New merchant. Redirecting to SWC. ServiceKey: 1846869E3691300C, AppPid: 0F4633D95001300C NOT M66128 | dedup MPID | eval date_wday=strftime(_time,"%w-%A")| chart count AS auth.net BY date_wday | appendcols [search source=Ipc.Sync.Web New merchant. Redirecting to SWC. ServiceKey: 970A36376A11300C, AppPid: A476DC90C001300C | dedup MPID | eval date_wday=strftime(_time,"%w-%A")| chart count AS clover BY date_wday ]| eval date_wday=replace(date_wday,"(\d+-)(\w+)","\2") </CODE></PRE> Tue, 19 Aug 2014 19:17:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187356#M53980 somesoni2 2014-08-19T19:17:08Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187357#M53981 <P>@somesoni2 that works great too...and don't need the lookup...thanks!</P> Tue, 19 Aug 2014 19:46:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187357#M53981 halkelley 2014-08-19T19:46:55Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187358#M53982 <P>There is one more option, same as sort but without using external lookup. See example 5 in this link</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Sort">http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Sort</A></P> Wed, 20 Aug 2014 08:39:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187358#M53982 strive 2014-08-20T08:39:24Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187359#M53983 <P>thanks <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/15147">@somesoni2</a> ,date_wday=strftime(_time,"%w-%A") suggestion from your query helped crack my usecase</P> Tue, 29 Sep 2020 14:27:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-data-in-chronological-order-by-day-of-the-week-not/m-p/187359#M53983 newbie2tech 2020-09-29T14:27:47Z