Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

[zd00191]

I have the following search that creates a bar chart with the days of the week on the vertical axis. THe days are in alphabetical order and I need them to be in order of the week to date so Sunday Monday tuesday wednesday thursday friday.

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" JOB_NAME="*" job_status=SUCCESS OR job_status=FAILURE OR job_status=RESTART OR job_status="TERMINATED" |stats count(JOB_NAME) as "Number of Jobs" by date_wday,job_status |eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field |xyseries date_wday,job_status,"Number of Jobs"

Please help! Thanks!

[aschneps]

Hi all,

for me and my needs a simpler way worked fine for me, just in regards or sorting Monday - Sunday in the order I like

Try this:

...|chart count(yourfiled) by date_hour date_wday | table date_hour, monday, thuesday,wednesday,thursday,friday,saturday,sunday | sort date_hour

Hope this helps everyone targeting the same problem.

[gavinliston]

I downvoted this post because did not work

[bgstein]

Worked for me and gave me just what I wanted. Thanks! Albeit for a simpler search.

[woodcock · Accepted solution]

Try this:

index=ko_autosys AND sourcetype=autosys_applog_scheduler_events AND JOB_NAME="*"
AND (host="usatlb98" OR host="usatlb91") 
AND (job_status="SUCCESS" OR job_status="FAILURE" OR job_status="RESTART" OR job_status="TERMINATED")
| stats count(JOB_NAME) as "Number of Jobs" BY date_wday job_status
| xyseries date_wday,job_status,"Number of Jobs"
| eval sort_field = case(date_wday=="monday",    1,
                         date_wday=="tuesday",   2,
                         date_wday=="wednesday", 3,
                         date_wday=="thursday",  4,
                         date_wday=="friday",    5,
                         date_wday=="saturday",  6,
                         date_wday=="sunday",    7)
| sort 0 sort_field
| fields - sort_field