Splunk Search

Sorting chart headers (dates) by descending

lukepatrick
Explorer

I am trying to sort the column headers of a chart (dates) so they appear with the most recent date on the far left. I was able to use eval strptime/strftime to get it to treat the values as a date format, but I cannot seem to get ascending / descending to work.

index="testname" sourcetype="source" ProjectName="Systems" |  eval RunDate = strptime(RunDate, "%m/%d/%Y") | sort RunDate | eval RunDate = strftime(RunDate, "%m/%d/%Y") | eval roundValue = round($Value$, 3) |chart Sum(roundValue) by PageName,RunDate | head 150

With this, my column headers, from left to right, are:
[index], PageName, 08/22/2018, 08/29/2018, 09/05/2018, 10/03/2018... etc.

Is it possible for me to sort these to be
[index], PageName, 10/03/2018, 09/05/2018, 08/29/2018.. etc??

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...