How to extract the dates in order in a dashboard

[Deprasad]

I have a query which extracts counts for last 30 days. But the dates are not in proper order in result.

index = *** "search phrase" | stats count by date_mday | rename date_mday as Date

If i make a search today for last 30 days, the result should be in the below order .

01/18, 19, 20 .......... 02/16,02/17.

[richgalloway · Accepted solution]

The date_mday field contains a single integer representing the day of the month on which the event occurred. Since there is no month information in the field, it's not reasonable to expect the month to be considered when sorting. Try sorting by _time, instead.

index=foo "search phrase" | bin span=1d _time | stats count by _time | rename _time as Date | fieldformat Date = strptime(Date, "%m/%d")

[efavreau]

Glad this is working for you, @Deprasad! Please remember to accept the answer, so this can help others too.

[Deprasad]

Thanks..! This is working, however the date field is in epoch format.

[richgalloway]

It's converted in my updated answer.

[Deprasad]

strptime(Date, "%m/%d") gave a blank result for Date. Gone through Splunk documentation and found for epoch time conversion the command is strftime(x,y).

Thanks for the help..!!