Splunk Search

In a chart count where days are the column header, how do I get the days to list in chronological order?

rossblassingame
New Member

I'm trying to get a table where "Days" are the column headers (chronologically) and hours are the row headers that show the total events that happened in each hour per day. Something like this:

Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

I think I have it mostly working with the following:

[code] | chart count over date_hour by date_wday

However, the days in the row headers are ordered alphabetically, not chronologically. So instead of:
Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday

What's showing in the chart is:

Friday | Monday | Saturday | Sunday | Thursday | Tuesday | Wednesday

Could anyone please help me figure this out?

Thanks.

Tags (3)
0 Karma
1 Solution

renjith_nair
Legend

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

---
What goes around comes around. If it helps, hit it with Karma 🙂

rossblassingame
New Member

Above answer led me to the right answer. What worked for me:

| chart count over date_hour by date_wday | fields date_hour, sunday, monday, tuesday, wednesday, thursday, friday, saturday

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...