Splunk Search

Column Chart - Sorting months chronologically and not alphabetically

DDewarSplunk
New Member

Morning Splunk Gurus

Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart

https://imgur.com/a/g8nor

Base Search.....
| chart count over date_month by Status

Many Thanks

D

0 Karma
1 Solution

nikita_p
Contributor

Hi,
You can try using timechart instead of chart command
....| timechart values(status)

View solution in original post

0 Karma

nickhills
Ultra Champion

If you don't mind using date numbers instead of date names:

*|eval dateM=strftime(_time,"%m")| chart count over dateM by Status |sort -dateM
If my comment helps, please give it a thumbs up!
0 Karma

DDewarSplunk
New Member

Yeah that could work I guess

0 Karma

nikita_p
Contributor

Hi,
You can try using timechart instead of chart command
....| timechart values(status)

View solution in original post

0 Karma

DDewarSplunk
New Member

Thanks Nikita

I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,

When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show

date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7

0 Karma

nikita_p
Contributor

Hi,
Is date_month is the field in your events?

0 Karma

nikita_p
Contributor

Also is date included in your logs?
And if good and bad are fields in your logs, you will have to do
..|timechart values(good) AS good values(bad) AS bad

0 Karma

DDewarSplunk
New Member

So the field is "Status" and the 2 values are Good and Bad

So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc

I just want to show 3 months and each month should have a 2 bars, each bar showing a value.

Yeah I have _time and date values in logs

Thanks again

0 Karma

nickhills
Ultra Champion

in which case, this should do it
*| timechart count by status

If my comment helps, please give it a thumbs up!
0 Karma

DDewarSplunk
New Member

Thanks Nick
Thanks nikita

0 Karma

DDewarSplunk
New Member

Yeah it is

ta

0 Karma

nikita_p
Contributor

Hi,
Is date included in your events?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!