How do you display days in chronological order not alphabetically?

[cwhurd1]

Hi,

I am using the below search to display the average transactions by day over a couple weeks. I need the days to show in chronological order. I have seen the Splunk Documentation, and I am still not able to figure it out. Any advice will be beneficial:

index=XXX sourcetype=XXXXX
| timechart span=1h dc(transactionID) as transactions
| eval weekday=strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| chart avg(transactions) as transactions by hour, weekday

[somesoni2 · Accepted solution]

Give this a try

 index=XXX sourcetype=XXXXX
 | timechart span=1h dc(transactionID) as transactions
 | eval weekday=strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday
| table hour Sunday Monday Tuesday Wednesday Thursday Friday Saturday

[cwhurd1]

This worked! Thank you!

[kamlesh_vaghela]

@cwhurd1

Can you please try below search?

index=XXX sourcetype=XXXXX
 | timechart span=1h dc(transactionID) as transactions
 | eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday
 | rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *

My Sample Search:

index=*
 | timechart span=1h count as transactions
 | eval weekday=strftime(_time,"%w")."_".strftime(_time,"%A")
 | eval hour=strftime(_time,"%H")
 | chart avg(transactions) as transactions by hour, weekday | rename 1_* as *,2_* as *,3_* as *,4_* as *,5_* as *,6_* as *,0_* as *

Here we know Splunk displays column name in alphabetical order, so I have provided day number as initial character of weekday and then renamed it.

thanks

[cwhurd1]

This did not work for me. It returned the same results.

[niketn]

@kamlesh_vaghela this will fail if Selected Time spans across multiple weeks as stated in the question 😉

%w (Week day from 0-6) and %A (Week day from Sunday- Saturday) will match for same days of the week so they will appear next to each other.