How to sort by date mm-dd-yy

[dinuManick]

For my dashboard, I am using the following regex. Although the current date is displayed at the end of the dashboard and the oldest date is displayed at the top, I require the date format to be mm-dd-yy only. My dashboard should show the most recent date at the top. Give me your finest recommendations, please.

| eval date=strftime(_time, "%m-%d-%y") | stats count by date,

[PickleRick]

Manipulating date in string format is counter-productive. Either render your date to string at the very end of your pipeline or (even better) use fieldformat to display the field in string format but keep it in numerical form so it's easier to deal with.

[isoutamo]

Hi

here is one way to do it

| eval date=strftime(_time,"%m-%d-%y"), date_s = strftime(_time, "%Y%m%d")
| stats count values(date) as date by date_s
| sort 0 - date_s
| table date count

You are needing a field which is numeric and can sorted by your wanted way.

r. Ismo 

[dinuManick]

Super , This is functioning, however the column is shifting. But thank you, I now have a solution.

[ITWhisperer · Accepted solution]

Format your time after stats and sorting

| bin _time span=1d
| stats count by _time
| sort 0 - _time
| fieldformat _time=strftime(_time,"%m-%d-%y")

[dinuManick]

Fantastic, many thanks This appears simple, and my output hasn't changed, i got latest date in top of the table now . Thank you