sort by Date & Time

[monipinni]

Wednesday December 4, 2019 8:24:37 AM
Wednesday December 11, 2019 3:33:35 PM
Wednesaday December 4, 2019 12:05:30 PM
Thursday December 5, 2019 7:53:29 PM

How to sort by date & time as per calender? Tried sort - Date , -Time

I am looking for output like

Wednesday December 4, 2019 8:24:37 AM
Wednesaday December 4, 2019 12:05:30 PM
Thursday December 5, 2019 7:53:29 PM
Wednesday December 11, 2019 3:33:35 PM

[richgalloway]

Date strings are sorted in ASCII order, not date order. The solution is to parse the dates into a separate field for sorting.

Base search | search feedback=Good | search "feedbackmessage"=* 
| eval epoch=sprptime(Date, "%A %B %d, %Y %I:%M:%S %p") | sort + epoch | table Date, time, feedback, feebackmessage

[jpolvino]

You can create a date sort field, use it for sorting, and then throw it away:

| makeresults
| eval date="Wednesday December 4, 2019"
| eval time="8:24:37 AM"
| eval feedback="Good"
| eval feedbackmessage="hsjdn"
| eval dateTime=date." ".time | rex field=dateTime mode=sed "s/\w+\s(.*)/\1/g"
| eval dateSort=strptime(dateTime,"%b %d, %Y %I:%M:%S %p")
| sort dateSort
| fields - dateSort

[oscar84x]

Can you share some more information? event samples and your query?
We'd need to see what fields you're working with.

[monipinni]

@oscar84x :Base search | search feedback=Good | search "feedbackmessage"=* | table date , time , feedback feedbackmessage | sort - Date

Date time feedback feedbackmessage
Wednesday December 4, 2019 8:24:37 AM Good hjsdn
Wednesday December 11, 2019 3:33:35 PM Good hduasjklk
Wednesaday December 4, 2019 12:05:30 PM Bad afstgahjd
Thursday December 5, 2019 7:53:29 PM IDEA qtdygwuhsk

output shld be date & time order in order like this

Wednesday December 4, 2019 8:24:37 AM
Wednesaday December 4, 2019 12:05:30 PM
Thursday December 5, 2019 7:53:29 PM
Wednesday December 11, 2019 3:33:35 PM