How to convert Aug-16 which is in text to a date format such that I can sort?

[ravitejaj]

For example I have the below data as text:

Aug-16
Sep-16
Oct-16
Nov-16
Feb-16

When I sort it with Month, I wish to see:

Feb-16
Aug-16
Sep-16
Oct-16
Nov-16

Currently When I sort, it shows as

Aug-16
Feb-16
Nov-16
Oct-16
Sep-16

[gokadroid]

Try this I am assuming your date is coming in a field myField

yourQuery to return myField
| eval newTime="00:00:00 01-".myField
| eval monthYear=strptime(newTime,"%H:%M:%S %d-%b-%y") 
| fieldformat monthYear=strftime(monthYear, "%b-%y")
| table myField, monthYear 
| sort monthYear

Try to replace last line | sort monthYear with | sort myField and see the difference.

[HiroshiSatoh]

How about converting for sorting?

・・・|eval sort_field=strptime(text_date,"%b-%d")|sort sort_field|fields - sort_field

[ravitejaj]

Hey Horishi,

This is not working.. First of all strptime is not returning any data.

eval text_date="Aug-16" | eval sort_field=strptime(text_date,"%b-%d")|sort sort_field|fields - sort_field | table sort_field

[HiroshiSatoh]

I am deleting the sort_field .

|fields - sort_field | table sort_field
↓
| table sort_field

[ravitejaj]

Still the Sort is not working..

[ravitejaj]

eval a=strftime(strptime(Approval_Month,"%b-%d"), "%b-%y") | table a | sort a

[HiroshiSatoh]

I mistook the day and the year.

eval a=strftime(strptime(Approval_Month,"%b-%d"), "%b-%y") | table a | sort a
↓
eval wk_Approval_Month="00:00:00:01-"+Approval_Month|eval a=strftime(strptime(wk_Approval_Month,"%H:%M:%S:%d-%b-%y"),"%Y-%m") | sort a

※a=2016-08