Search showing time in months in alphabetic order

[kml_uvce]

My search showing alphabetic order in months(like chart is in this order (dec,feb,jan, nov)

|eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b") | chart sum(lsCDR_duration) as Duration(in sec) over month

Can someone please help me on this ?

[gkanapathy · Accepted solution]

You can use the fieldformat command to retain numeric sort order, while changing how a field's value is displayed. You will need to rewrite your search, e.g."

<search> 
 | eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m")
 | fieldformat month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b")
 | chart sum(lsCDR_duration) as Duration(in sec) over month

[Ayn]

<search> | eval _month_num=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m") | eval month=strftime(lsCDR_endTime,"%Y-%m-%d"),"%b") | stats sum(lsCDR_duration) as "Duration(in sec)" by _month_num,month | sort _month_num

[lguinn2]

How about

| eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m") | chart sum(lsCDR_duration) as "Duration(in sec)" over month

which gives the month as a decimal number instead of the name of the month.

[kml_uvce]

but I want to show as month name in output