Morning Splunk Gurus
Can you tell me what is the simplest way of arranging months into order of date rather than alphabetical is?
Here is a link to my chart
| chart count over date_month by Status
You can try using timechart instead of chart command
....| timechart values(status)
I should have said I have 2 types of states....lets say "Good" and "Bad" and I get a value for each when using | chart count over date_month by Status - like below,
When I use ....| timechart values(status) - these good and bad values are not there and so my chart has nothing to show
date_month Good Bad
Dec 20 5
Nov 25 30
Oct 9 7
Also is date included in your logs?
And if good and bad are fields in your logs, you will have to do
..|timechart values(good) AS good values(bad) AS bad
So the field is "Status" and the 2 values are Good and Bad
So for Decembers you might have 20 good and 10 bad.....for Nov 15 good and 65 bad etc
I just want to show 3 months and each month should have a 2 bars, each bar showing a value.
Yeah I have _time and date values in logs