Splunk Search

How to edit my search to sort dates in calendar order?


Here is my search:

index=parmed-qa date_wday=monday |table _time date_month date_wday date_mday orderid|sort 0 _time|eval day_month=date_mday+"_"+date_month|chart count(orderid) by  day_month date_wday limit=0|

1_august 8
4_july 1
11_july 7
15_august 8
18_july 4
22_august 11
25_july 4

I want to get all those dates are in calendar order.

0 Karma


Try this

index=parmed-qa date_wday=monday | timechart count(orderid) as count | eval day_month=strftime(_time, "%d_%B")  
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!