Query to display data as per the DateTime column of Record

[sudarshan391]

Hello Splunk Experts, sorry if i am not able to format the question properly as I am new to splunk.

I have a csv file which having information of service tickets raised each month. it having 3 date-time column named "Created", "Assigned" and "Closed".
Ex. sample values which these column contains like "Closed" = "3/2/2017 10:04" .

I am trying to build a query which will display the tickets as per the "closed" column.
I have extracted the "Closed" column as "Closed" field. I am executing below query. but it is not giving the output as per the "Closed" column.

"index=service_ticket sourcetype=ServiceTicket | chart count by category | sort +num(count)"

Please help, how can i include or bring "Closed" date column in the above query.

Thank you in advance.

[sudarshan391]

Just want to add one more point here that splunk by default indexing or using the "Assigned" Date column because it is the first date column as per the alphabetical order. and How can i use or index "Closed" column?

[cmerriman]

if you want the "Closed" column included in the result, you can do something like this:

index=service_ticket sourcetype=ServiceTicket | chart count by Closed category 

[sudarshan391]

Thanks @cmerriman but it did not worked, the same result. Just want to add one more point here that splunk by default indexing or using the "Assigned" Date column as by default because it is the first date column as per the alphabetical order. and I am trying to index data as per "Closed" column.