Splunk Search
Highlighted

Sorting Date

Explorer

Okay so I missing something...

Here's my searches:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool useother=false | fieldformat Total=round(Total, 2) |rename auto_generated_pool_enterprise AS Total | tscollect namespace=License_Daily_Usage_7d keepresults=true

AND

| tstats sum(GB) AS Total, values(Total), values(Date) FROM License_Daily_Usage_7d groupby Date |  rename values(Total) AS Total_GB | convert timeformat="%a,  %m/%d/%y" ctime(_time) AS Date | sort _time | fields - _time | table Date, Total_GB 

And when the show up in the dashboard they are not being sorted by "Date" correctly...its doing:

Fri, 03/28/14 943.270143

Mon, 03/31/14 900.663402

Sat, 03/29/14 836.616432

Sun, 03/30/14 779.676332

Thu, 03/27/14 487.159979

Thu, 04/03/14 514.808743

Tue, 04/01/14 965.568267

Wed, 04/02/14 1031.553619

I've tried sorting by everything I can think of and it just won't sort by %m/%d/%y

Tags (2)
0 Karma
Highlighted

Re: Sorting Date

Champion

Hello,
Add a dummy column and do the sort and hide it

| tstats sum(GB) AS Total, values(Total), values(Date) FROM License_Daily_Usage_7d groupby Date |  rename values(Total) AS Total_GB |convert timeformat="%a,  %m/%d/%y" ctime(_time) AS Date|eval a=strptime(Date,"%a,  %m/%d/%y") | table Date, Total_GB,a| sort a | fields - a 

Thanks

Highlighted

Re: Sorting Date

Explorer

Thanks for the response but its still not working....

0 Karma
Highlighted

Re: Sorting Date

Champion

Try now, i didn't include the field in table column. This happens due to the date field not being actual date field rather a string..

0 Karma
Highlighted

Re: Sorting Date

Explorer

Still no luck 😞

0 Karma
Highlighted

Re: Sorting Date

Champion

Okay now check the edited one?

0 Karma
Highlighted

Re: Sorting Date

SplunkTrust
SplunkTrust

You second search (tstats) is not retrieving field _time.

0 Karma
Highlighted

Re: Sorting Date

Explorer

Thanks for the response but its still not working....

0 Karma
Highlighted

Re: Sorting Date

Motivator

if you keep the field _time, does it sort?

0 Karma
Highlighted

Re: Sorting Date

Explorer

No 😞 .....

0 Karma