Splunk Search

In a chart count where days are the column header, how do I get the days to list in chronological order?

rossblassingame
New Member

I'm trying to get a table where "Days" are the column headers (chronologically) and hours are the row headers that show the total events that happened in each hour per day. Something like this:

Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

I think I have it mostly working with the following:

[code] | chart count over date_hour by date_wday

However, the days in the row headers are ordered alphabetically, not chronologically. So instead of:
Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday

What's showing in the chart is:

Friday | Monday | Saturday | Sunday | Thursday | Tuesday | Wednesday

Could anyone please help me figure this out?

Thanks.

Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

Happy Splunking!

rossblassingame
New Member

Above answer led me to the right answer. What worked for me:

| chart count over date_hour by date_wday | fields date_hour, sunday, monday, tuesday, wednesday, thursday, friday, saturday

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...