Splunk Search

How to sort the month when using the field in chart over command?

sangs8788
Communicator

Hi

Below is a query which returns the latency over month by cust_id. Events contain fields as month=April, month=May etc

...| chart  max(Avg) as Avg, max(Max) as Max, p95(P95) as P95 over month by cust_id  useother=f limit=40 |sort  -Max, -P95 

The query shows result in sorted by month name since month is a string. How do i sort by calendar series and display as a chart ?![alt text][1]

0 Karma
1 Solution

sangs8788
Communicator

I found the answer. This worked

| eval  sort=case(       Month=="January","1",       Month=="February","2",       Month=="March","3",       Month=="April","4",       Month=="May","5",       Month=="June","6",       Month=="July","7",       Month=="August","8",       Month=="Septempber","9",       Month=="October","10",       Month=="November","11",       Month=="December","12")|sort sort |fields - sort

View solution in original post

0 Karma

sangs8788
Communicator

I found the answer. This worked

| eval  sort=case(       Month=="January","1",       Month=="February","2",       Month=="March","3",       Month=="April","4",       Month=="May","5",       Month=="June","6",       Month=="July","7",       Month=="August","8",       Month=="Septempber","9",       Month=="October","10",       Month=="November","11",       Month=="December","12")|sort sort |fields - sort
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...