Dashboards & Visualizations

Reporting / Dashboard issues

magneto417x
New Member

So I am using the following search to grab data:

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | streamstats avg(daycount) |

Issue I noticed today when looking at month to date it orders result in below order which also messes up bar chart any suggestions to fix would be much appreciated.

1
10
2
3
4
5
6
7
8
9

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

Quick note, I am not entirely sure what you are doing with the eval Time ... step because that doesn't have any effect.

Regadless, you can fix your sorting problem by adding a leading zero to date_mday. Add this to your search for ascending calendar dates..

| eval date_mday = if(date_mday < 10, "0".tostring(date_mday), tostring(date_mday)) | sort +date_mday

View solution in original post

0 Karma

puneethgowda
Communicator

eval Time=strftime(_time,"%b %Y")

You are not using eval for any results.

My suggestion is to make use of strftime

Like below

eval datemday=strftime(_time,????)

Give the required format

And count by datemday

You can also use raw date column instead of _tim because daylight matters

0 Karma

magneto417x
New Member

I'm not sure I understand that would make my search be then I tried it a few times and it fails. Would you be able to post what the complete statement would look like?

0 Karma

puneethgowda
Communicator

Sleeping time in India now let me try tomorrow

0 Karma

rjthibod
Champion

Quick note, I am not entirely sure what you are doing with the eval Time ... step because that doesn't have any effect.

Regadless, you can fix your sorting problem by adding a leading zero to date_mday. Add this to your search for ascending calendar dates..

| eval date_mday = if(date_mday < 10, "0".tostring(date_mday), tostring(date_mday)) | sort +date_mday

0 Karma

rjthibod
Champion

@magneto417X Did you try my suggestion of prepending the 0 to some dates?

0 Karma

magneto417x
New Member

That worked. Thanks 🙂

0 Karma

magneto417x
New Member

Not yet had to go to a meeting but plan to give it a spin when I'm back. I will try and update thread 🙂

0 Karma

somesoni2
Revered Legend

Try like this

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | sort 0 num(date_mday) | streamstats avg(daycount) 
0 Karma

magneto417x
New Member

The returns same results and still not in order 😞

0 Karma

somesoni2
Revered Legend

That works for me for similar query. Did you use the exact query I gave or there was any modification. Give @rjthibod's answer a try then.

0 Karma

magneto417x
New Member

Copied the query and ran it and it failed 😞

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...