Sorting Months in a Field

[henryt1]

So I wasn't really sure how to do this after reading the documentation, but I'm running the following search:

(host="web01.x.com") AND (source="/common/site-logs/x-activity.log") AND ("create" AND "project") NOT ("brief" OR "campaign" OR "proposal" OR "talentlist" OR "teamroom" OR "view" OR "criteria" OR "problem") | stats count by date_month

I get the data back that I want, however the months are in alphabetical order instead of by date. How can I sort these to be in date order with how they would go on a calendar?

Thanks in advance.

-Tyler

[gkanapathy · Accepted solution]

don't use the date_month field. They are unreliable. use

... | bucket _time span=1mon | stats count by _time

[henryt1]

Great! Thank you!