Splunk Search

How to sort events in ascending order by date with the correct date format?

abovebeyond
Communicator

Hello,

I'm trying to order specific events from our application log for visualization.

search string :

index="applicationlogsindex" Credit card was declined | stats count as NumEvents by date_mday

i have 2 problems :

1) for some reason the dates are ordered by the first number.
how can i sort it by the the correct date in ascending order?

2) the date shown up is just a single number. For example today is the 15th, i need a date like DD\MM

Thanks

Tags (4)
0 Karma
1 Solution

fdi01
Motivator

1) to ascending order, use sort command like this:

index="applicationlogsindex" Credit card was declined | stats count as NumEvents by date_mday|sort  date_mday

2) to shown up the date, use _time field like this:

index="applicationlogsindex" Credit card was declined | stats count as NumEvents by _time

or

index="applicationlogsindex" Credit card was declined|sort _time|eval  date_mday=_time| stats count as NumEvents by date_mday

View solution in original post

fdi01
Motivator

1) to ascending order, use sort command like this:

index="applicationlogsindex" Credit card was declined | stats count as NumEvents by date_mday|sort  date_mday

2) to shown up the date, use _time field like this:

index="applicationlogsindex" Credit card was declined | stats count as NumEvents by _time

or

index="applicationlogsindex" Credit card was declined|sort _time|eval  date_mday=_time| stats count as NumEvents by date_mday

abovebeyond
Communicator

Thanks !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...