Splunk Search

In a chart count where days are the column header, how do I get the days to list in chronological order?

rossblassingame
New Member

I'm trying to get a table where "Days" are the column headers (chronologically) and hours are the row headers that show the total events that happened in each hour per day. Something like this:

Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

I think I have it mostly working with the following:

[code] | chart count over date_hour by date_wday

However, the days in the row headers are ordered alphabetically, not chronologically. So instead of:
Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday

What's showing in the chart is:

Friday | Monday | Saturday | Sunday | Thursday | Tuesday | Wednesday

Could anyone please help me figure this out?

Thanks.

Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@rossblassingame

Try mentioning the headers in the field list like | chart count over date_hour by date_wday|fields Monday,Tuesday ,Wednesday ,Thursday ,Friday,Saturday

Happy Splunking!

rossblassingame
New Member

Above answer led me to the right answer. What worked for me:

| chart count over date_hour by date_wday | fields date_hour, sunday, monday, tuesday, wednesday, thursday, friday, saturday

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...