timestamp

[lorscardala985]

i have a problem with the timestamp when i parsing the data, i want the date to start with 28/04/2023 and end with 03/05/2023 but it start with 30/04 then 29/04 and end with 28/04, who can i start the data with 28/04 and not 30/04

[lorscardala985]

sc.png

search4.png

this are my sourcetype and the problem with the date

[ITWhisperer]

This issue doesn't appear to be with the dates per se, it is that the x-axis is sorted lexicographically (alphabetically) - either change your date format to YYYY/MM/DD or change the search so that the results are sorted by ascend time order.

[gcusello]

Hi @lorscardala985 ,

are you speaking of the parsing phase or the search outputs ?

if in the parsing phase, the date is extracted from the log so there isn't a starting or ending date.

If you're speaking of the search output, you can change the sorting order using the sort command:

<your_search>
| sort _time
| table ...

Ciao.

Giuseppe

[ITWhisperer]

It sounds like the timerange for your search is not correct - how are you setting this?

Also, event usually come back in reverse chronological order (latest first). You can reverse the order with the reverse command or sort command (using _time as the sort variable).