I have a string fields like '28 Aug-1233456' , '05 Jan-5678999' ,'02 Feb-6789011'. I want to sort the field on the basis of date and month .Please let me know how can I sort this fields .
Expected Output :
'05 Jan-5678999' ,02 Feb-6789011',28 Aug-1233456'
Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!
the easiest way is convert date as epoch then sort with it and then remove/hide that field.
I'm not sure what you are meaning with that -123456, -34112 etc. Is it just a random number/string or should it contain year, hour, min ....?
... | eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7) | eval sTime = strptime(sTime, "%d %b") | sort sTime, rTime | fields - sTime, rTime
@romansha what is your SPL which generates fields like above? We would have to fix the fieldname before making them columns.