For my dashboard, I am using the following regex. Although the current date is displayed at the end of the dashboard and the oldest date is displayed at the top, I require the date format to be mm-dd-yy only. My dashboard should show the most recent date at the top. Give me your finest recommendations, please.
| eval date=strftime(_time, "%m-%d-%y") | stats count by date,
Format your time after stats and sorting
| bin _time span=1d
| stats count by _time
| sort 0 - _time
| fieldformat _time=strftime(_time,"%m-%d-%y")
Manipulating date in string format is counter-productive. Either render your date to string at the very end of your pipeline or (even better) use fieldformat to display the field in string format but keep it in numerical form so it's easier to deal with.
Hi
here is one way to do it
| eval date=strftime(_time,"%m-%d-%y"), date_s = strftime(_time, "%Y%m%d")
| stats count values(date) as date by date_s
| sort 0 - date_s
| table date count
You are needing a field which is numeric and can sorted by your wanted way.
r. Ismo
Format your time after stats and sorting
| bin _time span=1d
| stats count by _time
| sort 0 - _time
| fieldformat _time=strftime(_time,"%m-%d-%y")
Fantastic, many thanks This appears simple, and my output hasn't changed, i got latest date in top of the table now . Thank you