https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215490#M63173 <PRE><CODE>|eval Time=strftime(_time, "%H:%M:%S") | eval Date=strftime(_time, "%A %F") </CODE></PRE> <P>This works too</P> <P>Thanks!</P> Mon, 15 Aug 2016 15:26:17 GMT packet_hunter 2016-08-15T15:26:17Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215484#M63167 <P>Here is the data when sorted recent first....</P> <P>11:25:22<BR /> 11:25:23<BR /> 11:25:51<BR /> 11:25:52<BR /> 11:25:53<BR /> 11:5:37<BR /> 11:5:38<BR /> 11:5:42<BR /> 11:6:2<BR /> 11:6:5<BR /> 11:6:6 </P> <P>Any ideas?</P> Mon, 08 Aug 2016 19:43:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215484#M63167 packet_hunter 2016-08-08T19:43:50Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215485#M63168 <PRE><CODE>....|eval Time=date_hour.":".date_minute.":".date_second | eval Date = date_wday." ".date_month."/".date_mday."/".date_year |stats list(message_subject) as subj list(sender) as sender list(recipient) as recp list(file_name) as AttachmentName list(attachment_type) as AttachmentType list(vendor_action) as status values(Time) as Time values(Date) as Date by internal_message_id .... </CODE></PRE> <P>This is a sample of the code I use to get the events with time and date...</P> Mon, 08 Aug 2016 19:47:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215485#M63168 packet_hunter 2016-08-08T19:47:02Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215486#M63169 <P>Try this</P> <PRE><CODE>.... | eval Time=strftime(strptime(date_hour.":".date_minute.":".date_second,"%H:%M:%S"),"%H:%M:%S) | ... </CODE></PRE> <P>It should normalize Time to use 2-digit minute and second fields (hour, too). Then the events will sort properly.</P> Mon, 08 Aug 2016 20:46:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215486#M63169 richgalloway 2016-08-08T20:46:57Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215487#M63170 <P>Thank you Rick!!! Do you also have the date cure too? So that days and months are in the proper chronological order. </P> <P>Thanks again</P> Mon, 08 Aug 2016 20:52:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215487#M63170 packet_hunter 2016-08-08T20:52:05Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215488#M63171 <P>Date is similar.</P> <PRE><CODE>... | eval Date=strftime(strptime(date_wday." ".date_month."/".date_mday."/".date_year, "%a %m/%d/%Y"),"%a %m/%d/%Y") | ... </CODE></PRE> <P>I suspect, however, there's a better way using _time to get the events in order. Depends on what you're trying to do.</P> Mon, 08 Aug 2016 21:06:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215488#M63171 richgalloway 2016-08-08T21:06:58Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215489#M63172 <P>agreed, I am sure there is a better way but this should get the answers I need today...<BR /> Thank you</P> Mon, 08 Aug 2016 21:39:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215489#M63172 packet_hunter 2016-08-08T21:39:27Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215490#M63173 <PRE><CODE>|eval Time=strftime(_time, "%H:%M:%S") | eval Date=strftime(_time, "%A %F") </CODE></PRE> <P>This works too</P> <P>Thanks!</P> Mon, 15 Aug 2016 15:26:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-time-so-that-minute-values-are-in-correct-order/m-p/215490#M63173 packet_hunter 2016-08-15T15:26:17Z