Splunk Search

Does Splunk have the ability to sort by month-year?

nick405060
Motivator

I have data that looks like Jan-19 and I want to sort by it. Except I can't, because strptime("Jan-19","%b-%y") does not work, even though e.g. strptime("Jan-1-19","%b-%d-%y") does.

How do I workaround this (presumably extremely common but not documented or fixed) bug?

0 Karma

nick405060
Motivator

I posted this for the community so it could be documented. The best workaround I've seen was presented by @chrisyoungerjds:

strptime("1-" + "Jan-19","%d-%b-%y")

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...