Splunk Search

Query to display data as per the DateTime column of Record

sudarshan391
Path Finder

Hello Splunk Experts, sorry if i am not able to format the question properly as I am new to splunk.

I have a csv file which having information of service tickets raised each month. it having 3 date-time column named "Created", "Assigned" and "Closed".
Ex. sample values which these column contains like "Closed" = "3/2/2017 10:04" .

I am trying to build a query which will display the tickets as per the "closed" column.
I have extracted the "Closed" column as "Closed" field. I am executing below query. but it is not giving the output as per the "Closed" column.

"index=service_ticket sourcetype=ServiceTicket | chart count by category | sort +num(count)"

Please help, how can i include or bring "Closed" date column in the above query.

Thank you in advance.

Tags (3)
0 Karma

sudarshan391
Path Finder

Just want to add one more point here that splunk by default indexing or using the "Assigned" Date column because it is the first date column as per the alphabetical order. and How can i use or index "Closed" column?

0 Karma

cmerriman
Super Champion

if you want the "Closed" column included in the result, you can do something like this:

index=service_ticket sourcetype=ServiceTicket | chart count by Closed category 
0 Karma

sudarshan391
Path Finder

Thanks @cmerriman but it did not worked, the same result. Just want to add one more point here that splunk by default indexing or using the "Assigned" Date column as by default because it is the first date column as per the alphabetical order. and I am trying to index data as per "Closed" column.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.