Splunk Search

Sorting Months in a Field

henryt1
Path Finder

So I wasn't really sure how to do this after reading the documentation, but I'm running the following search:

(host="web01.x.com") AND (source="/common/site-logs/x-activity.log") AND ("create" AND "project") NOT ("brief" OR "campaign" OR "proposal" OR "talentlist" OR "teamroom" OR "view" OR "criteria" OR "problem") | stats count by date_month

I get the data back that I want, however the months are in alphabetical order instead of by date. How can I sort these to be in date order with how they would go on a calendar?

Thanks in advance.

-Tyler

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

don't use the date_month field. They are unreliable. use

... | bucket _time span=1mon | stats count by _time

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

don't use the date_month field. They are unreliable. use

... | bucket _time span=1mon | stats count by _time

View solution in original post

0 Karma

henryt1
Path Finder

Great! Thank you!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!