Splunk Search
Highlighted

Column Chart - Sorting months chronologically and not alphabetically

New Member

Morning Splunk Gurus

Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart

https://imgur.com/a/g8nor

Base Search.....
| chart count over date_month by Status

Many Thanks

D

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

Contributor

Hi,
Is date included in your events?

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

Contributor

Hi,
You can try using timechart instead of chart command
....| timechart values(status)

View solution in original post

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

New Member

Thanks Nikita

I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,

When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show

date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

Contributor

Hi,
Is date_month is the field in your events?

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

New Member

Yeah it is

ta

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

Contributor

Also is date included in your logs?
And if good and bad are fields in your logs, you will have to do
..|timechart values(good) AS good values(bad) AS bad

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

New Member

So the field is "Status" and the 2 values are Good and Bad

So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc

I just want to show 3 months and each month should have a 2 bars, each bar showing a value.

Yeah I have _time and date values in logs

Thanks again

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

Ultra Champion

in which case, this should do it
*| timechart count by status

0 Karma
Highlighted

Re: Column Chart - Sorting months chronologically and not alphabetically

New Member

Thanks Nick
Thanks nikita

0 Karma