Hi all I am trying to sort dynamic columns in a table where the column names are in datetime format
e.g something like 30-Jun-2015 01-Jul-2015 02-Jul-2015 & so on.
sourcetype=shmapplogs "getMS3SAS ended for - deviceId" "EncryptedChannelKey" | bucket span=1d _time | stats count by _time channelId | sort count desc | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position by _time | fields channel_name_letter position _time | convert timeformat="%d-%b-%Y" ctime(_time) As Time | chart useother=f max(position) over channel_name_letter by Time limit=1000 | sort - Time | rename channel_name_letter as "Channel"
Form the above search i am getting the column names in the order like 01-Jul-2015 02-Jul-2015 30-Jun-2015 i.e they are being sorted based on day of the date and not based on the entire date. I want to sort the column names based on the entire date.