Column Chart - Sorting months chronologically and not alphabetically

[DDewarSplunk]

Morning Splunk Gurus

Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart

https://imgur.com/a/g8nor

Base Search.....
| chart count over date_month by Status

Many Thanks

D

[nickhills]

If you don't mind using date numbers instead of date names:

*|eval dateM=strftime(_time,"%m")| chart count over dateM by Status |sort -dateM

[DDewarSplunk]

Yeah that could work I guess

[nikita_p · Accepted solution]

Hi,
You can try using timechart instead of chart command
....| timechart values(status)

[DDewarSplunk]

Thanks Nikita

I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,

When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show

date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7

[nikita_p]

Hi,
Is date_month is the field in your events?

[nikita_p]

Also is date included in your logs?
And if good and bad are fields in your logs, you will have to do
..|timechart values(good) AS good values(bad) AS bad

[DDewarSplunk]

So the field is "Status" and the 2 values are Good and Bad

So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc

I just want to show 3 months and each month should have a 2 bars, each bar showing a value.

Yeah I have _time and date values in logs

Thanks again

[nickhills]

in which case, this should do it
*| timechart count by status

[DDewarSplunk]

Thanks Nick
Thanks nikita

[DDewarSplunk]

Yeah it is

ta

[nikita_p]

Hi,
Is date included in your events?