Morning Splunk Gurus
Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart
| chart count over date_month by Status
If you don't mind using date numbers instead of date names:
*|eval dateM=strftime(_time,"%m")| chart count over dateM by Status |sort -dateM
I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,
When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show
date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7
So the field is "Status" and the 2 values are Good and Bad
So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc
I just want to show 3 months and each month should have a 2 bars, each bar showing a value.
Yeah I have _time and date values in logs