Splunk Search

Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

zd00191
Communicator

I have the following search that creates a bar chart with the days of the week on the vertical axis. THe days are in alphabetical order and I need them to be in order of the week to date so Sunday Monday tuesday wednesday thursday friday.

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" JOB_NAME="*" job_status=SUCCESS OR job_status=FAILURE OR job_status=RESTART OR job_status="TERMINATED" |stats count(JOB_NAME) as "Number of Jobs" by date_wday,job_status |eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field |xyseries date_wday,job_status,"Number of Jobs"

Please help! Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index=ko_autosys AND sourcetype=autosys_applog_scheduler_events AND JOB_NAME="*"
AND (host="usatlb98" OR host="usatlb91") 
AND (job_status="SUCCESS" OR job_status="FAILURE" OR job_status="RESTART" OR job_status="TERMINATED")
| stats count(JOB_NAME) as "Number of Jobs" BY date_wday job_status
| xyseries date_wday,job_status,"Number of Jobs"
| eval sort_field = case(date_wday=="monday",    1,
                         date_wday=="tuesday",   2,
                         date_wday=="wednesday", 3,
                         date_wday=="thursday",  4,
                         date_wday=="friday",    5,
                         date_wday=="saturday",  6,
                         date_wday=="sunday",    7)
| sort 0 sort_field
| fields - sort_field

View solution in original post

aschneps
Engager

Hi all,

for me and my needs a simpler way worked fine for me, just in regards or sorting Monday - Sunday in the order I like

Try this:

...|chart count(yourfiled) by date_hour date_wday | table date_hour, monday, thuesday,wednesday,thursday,friday,saturday,sunday | sort date_hour

Hope this helps everyone targeting the same problem.

gavinliston
Engager

I downvoted this post because did not work

0 Karma

bgstein
Path Finder

Worked for me and gave me just what I wanted. Thanks! Albeit for a simpler search.

0 Karma

woodcock
Esteemed Legend

Try this:

index=ko_autosys AND sourcetype=autosys_applog_scheduler_events AND JOB_NAME="*"
AND (host="usatlb98" OR host="usatlb91") 
AND (job_status="SUCCESS" OR job_status="FAILURE" OR job_status="RESTART" OR job_status="TERMINATED")
| stats count(JOB_NAME) as "Number of Jobs" BY date_wday job_status
| xyseries date_wday,job_status,"Number of Jobs"
| eval sort_field = case(date_wday=="monday",    1,
                         date_wday=="tuesday",   2,
                         date_wday=="wednesday", 3,
                         date_wday=="thursday",  4,
                         date_wday=="friday",    5,
                         date_wday=="saturday",  6,
                         date_wday=="sunday",    7)
| sort 0 sort_field
| fields - sort_field
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...