Splunk Search
Highlighted

Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

Communicator

I have the following search that creates a bar chart with the days of the week on the vertical axis. THe days are in alphabetical order and I need them to be in order of the week to date so Sunday Monday tuesday wednesday thursday friday.

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" JOB_NAME="*" job_status=SUCCESS OR job_status=FAILURE OR job_status=RESTART OR job_status="TERMINATED" |stats count(JOB_NAME) as "Number of Jobs" by date_wday,job_status |eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field |xyseries date_wday,job_status,"Number of Jobs"

Please help! Thanks!

0 Karma
Highlighted

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

Esteemed Legend

Try this:

index=ko_autosys AND sourcetype=autosys_applog_scheduler_events AND JOB_NAME="*"
AND (host="usatlb98" OR host="usatlb91") 
AND (job_status="SUCCESS" OR job_status="FAILURE" OR job_status="RESTART" OR job_status="TERMINATED")
| stats count(JOB_NAME) as "Number of Jobs" BY date_wday job_status
| xyseries date_wday,job_status,"Number of Jobs"
| eval sort_field = case(date_wday=="monday",    1,
                         date_wday=="tuesday",   2,
                         date_wday=="wednesday", 3,
                         date_wday=="thursday",  4,
                         date_wday=="friday",    5,
                         date_wday=="saturday",  6,
                         date_wday=="sunday",    7)
| sort 0 sort_field
| fields - sort_field

View solution in original post

Highlighted

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

Engager

Hi all,

for me and my needs a simpler way worked fine for me, just in regards or sorting Monday - Sunday in the order I like

Try this:

...|chart count(yourfiled) by datehour datewday | table datehour, monday, thuesday,wednesday,thursday,friday,saturday,sunday | sort datehour

Hope this helps everyone targeting the same problem.

Highlighted

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

Engager

I downvoted this post because did not work

0 Karma
Highlighted

Re: Days in Alphabetical Order but need to be in day order..Tried using documentation advice but still won't work

Path Finder

Worked for me and gave me just what I wanted. Thanks! Albeit for a simpler search.

0 Karma