Splunk Search

How to sort data in chronological order by month, not alphabetically?

karthikTIL
Path Finder

HI,

For my below query, i get months in alphabetical order like april-2014, august-2014, february-2014, January-2014.

But i want this to be sorted like January-2014, February-2014. Please let me know.

source="test.csv"| eval Month=date_month."-".date_year|stats count(Incidents) by Month
Tags (3)
1 Solution

Ayn
Legend

Splunk has no idea that "January" corresponds to month "1" and "February" corresponds to month "2". You need to tell it. One simple way of doing that is creating a numerical field to sort by and use that:

source=test.csv | strftime month_num=strftime(_time,"%m") | eval Month=date_month."-".date_year | stats count(Incidents) by month_num,Month | sort month_num | fields - month_num

View solution in original post

frsouza
New Member

You can use timechart (what do you want to correlate with months). In your case, if you want to know the Incidents per month, would be | timechart count by Incidents

0 Karma

sunilsk1
Path Finder

The following converts the month into Y-m format and the numerical sorting helps out.

base search |convert ctime(_time) as Time timeformat=%Y-%m|chart avg(yourfield) over Time by some_other_field|sort Time

pbarbuto
Path Finder

I used the following for fiscal years.

 | eval sort=case(
     Month=="AUG","01",
     Month=="SEP","02",
     Month=="OCT","03",
     Month=="NOV","04",
     Month=="DEC","05",
     Month=="JAN","06",
     Month=="FEB","07",
     Month=="MAR","08",
     Month=="APR","09",
     Month=="MAY","10",
     Month=="JUN","11",
     Month=="JUL","12")
| sort sort     
| fields - sort

Ayn
Legend

Splunk has no idea that "January" corresponds to month "1" and "February" corresponds to month "2". You need to tell it. One simple way of doing that is creating a numerical field to sort by and use that:

source=test.csv | strftime month_num=strftime(_time,"%m") | eval Month=date_month."-".date_year | stats count(Incidents) by month_num,Month | sort month_num | fields - month_num

View solution in original post

agoriawala_splu
Splunk Employee
Splunk Employee

I have a field Month which has values as [Jan,Feb,Mar ....]. I tried the above solution but it didn't work for me.

0 Karma

karthikTIL
Path Finder

Thank you, it works

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!