If you want to order columns in that date order, then you cannot sort columns. You can use
| table a b c d e f
but that's probably not useful, so in the past I have used transpose to turn columns to values, then sort the values (first converting them to dates) and then transpose back to columns, along the lines of
| makeresults
| eval cols=split("10 Sep-26789,09 Sep-256789,31 Aug-256670,10 Sep-26780",",")
| mvexpand cols
| eval mydata=random()
| fields - _time
| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id
| transpose 0 header_field=cols
See how the transpose at the end converts the sorted cols field back to columns in the right order.
Not sure how this will work with your data though.
If you are actually talking about field values with those values, then the last part will do the sort, i.e.
| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id
of course, you don't have a year, so that will not work around Dec/Jan. The rex statement is just to correctly sort those random ids if there is the same date.
Hope this is useful
Hi
the easiest way is convert date as epoch then sort with it and then remove/hide that field.
... | eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7) | eval sTime = strptime(sTime, "%d %b") | sort sTime, rTime | fields - sTime, rTime
r. Ismo