Splunk Search

In a chart count where days are the column header, how do I get the days to list in chronological order?

rossblassingame
New Member

I'm trying to get a table where "Days" are the column headers (chronologically) and hours are the row headers that show the total events that happened in each hour per day. Something like this:

Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

I think I have it mostly working with the following:

[code] | chart count over date_hour by date_wday

However, the days in the row headers are ordered alphabetically, not chronologically. So instead of:
Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday

What's showing in the chart is:

Friday | Monday | Saturday | Sunday | Thursday | Tuesday | Wednesday

Could anyone please help me figure this out?

Thanks.

Tags (3)
0 Karma
1 Solution

renjith_nair
Legend

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

---
What goes around comes around. If it helps, hit it with Karma 🙂

rossblassingame
New Member

Above answer led me to the right answer. What worked for me:

| chart count over date_hour by date_wday | fields date_hour, sunday, monday, tuesday, wednesday, thursday, friday, saturday

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...