Splunk Search

Sorting Months in a Field

Path Finder

So I wasn't really sure how to do this after reading the documentation, but I'm running the following search:

(host="web01.x.com") AND (source="/common/site-logs/x-activity.log") AND ("create" AND "project") NOT ("brief" OR "campaign" OR "proposal" OR "talentlist" OR "teamroom" OR "view" OR "criteria" OR "problem") | stats count by date_month

I get the data back that I want, however the months are in alphabetical order instead of by date. How can I sort these to be in date order with how they would go on a calendar?

Thanks in advance.

-Tyler

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

don't use the date_month field. They are unreliable. use

... | bucket _time span=1mon | stats count by _time

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

don't use the date_month field. They are unreliable. use

... | bucket _time span=1mon | stats count by _time

View solution in original post

0 Karma

Path Finder

Great! Thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!