Splunk Search
Highlighted

How to sort Dynamic Columns with names as dates

Path Finder

Hi all I am trying to sort dynamic columns in a table where the column names are in datetime format
e.g something like 30-Jun-2015 01-Jul-2015 02-Jul-2015 & so on.

My query

sourcetype=shmapplogs "getMS3SAS ended for - deviceId" "EncryptedChannelKey" | bucket span=1d _time | stats count by _time channelId | sort count desc | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position by _time | fields channel_name_letter position _time | convert timeformat="%d-%b-%Y" ctime(_time) As Time | chart useother=f max(position) over channel_name_letter by Time limit=1000 | sort - Time | rename channel_name_letter as "Channel"

Form the above search i am getting the column names in the order like 01-Jul-2015 02-Jul-2015 30-Jun-2015 i.e they are being sorted based on day of the date and not based on the entire date. I want to sort the column names based on the entire date.
Please help.

Tags (4)
0 Karma
Highlighted

Re: How to sort Dynamic Columns with names as dates

SplunkTrust
SplunkTrust

Try something like this

sourcetype=shmapplogs "getMS3SAS ended for - deviceId" "EncryptedChannelKey" | bucket span=1d _time | stats count by _time channelId | sort count desc | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position by _time | fields channel_name_letter position _time | convert timeformat="%d-%b-%Y" ctime(_time) As Time | chart useother=f max(position) over channel_name_letter by Time limit=1000  | rename channel_name_letter as "Channel" | table Channel [| gentimes start=-1 | addinfo | eval sno=mvrange(0,round((info_max_time-info_min_time)/86400,0)) | table info_min_time sno| mvexpand sno | eval temp=relative_time(info_min_time,"+".sno."d") | convert timeformat="%d-%b-%Y" ctime(temp) As temp| stats list(temp) as temp delim="," | nomv temp | return $temp]