Dashboards & Visualizations

How to extract the dates in order in a dashboard

Engager

I have a query which extracts counts for last 30 days. But the dates are not in proper order in result.

index = *** "search phrase" | stats count by date_mday | rename date_mday as Date

If i make a search today for last 30 days, the result should be in the below order .

01/18, 19, 20 .......... 02/16,02/17.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The date_mday field contains a single integer representing the day of the month on which the event occurred. Since there is no month information in the field, it's not reasonable to expect the month to be considered when sorting. Try sorting by _time, instead.

index=foo "search phrase" | bin span=1d _time | stats count by _time | rename _time as Date | fieldformat Date = strptime(Date, "%m/%d")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

The date_mday field contains a single integer representing the day of the month on which the event occurred. Since there is no month information in the field, it's not reasonable to expect the month to be considered when sorting. Try sorting by _time, instead.

index=foo "search phrase" | bin span=1d _time | stats count by _time | rename _time as Date | fieldformat Date = strptime(Date, "%m/%d")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Builder

Glad this is working for you, @Deprasad! Please remember to accept the answer, so this can help others too.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

Thanks..! This is working, however the date field is in epoch format.

0 Karma

SplunkTrust
SplunkTrust

It's converted in my updated answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

strptime(Date, "%m/%d") gave a blank result for Date. Gone through Splunk documentation and found for epoch time conversion the command is strftime(x,y).

Thanks for the help..!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!