Splunk Search

How to edit my search to sort dates in calendar order?

uhkc777
Explorer

Here is my search:

index=parmed-qa date_wday=monday |table _time date_month date_wday date_mday orderid|sort 0 _time|eval day_month=date_mday+"_"+date_month|chart count(orderid) by  day_month date_wday limit=0|

1_august 8
4_july 1
11_july 7
15_august 8
18_july 4
22_august 11
25_july 4

I want to get all those dates are in calendar order.

0 Karma

sundareshr
Legend

Try this

index=parmed-qa date_wday=monday | timechart count(orderid) as count | eval day_month=strftime(_time, "%d_%B")  
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...