Splunk Search

Sorting chart headers (dates) by descending

lukepatrick
Explorer

I am trying to sort the column headers of a chart (dates) so they appear with the most recent date on the far left. I was able to use eval strptime/strftime to get it to treat the values as a date format, but I cannot seem to get ascending / descending to work.

index="testname" sourcetype="source" ProjectName="Systems" |  eval RunDate = strptime(RunDate, "%m/%d/%Y") | sort RunDate | eval RunDate = strftime(RunDate, "%m/%d/%Y") | eval roundValue = round($Value$, 3) |chart Sum(roundValue) by PageName,RunDate | head 150

With this, my column headers, from left to right, are:
[index], PageName, 08/22/2018, 08/29/2018, 09/05/2018, 10/03/2018... etc.

Is it possible for me to sort these to be
[index], PageName, 10/03/2018, 09/05/2018, 08/29/2018.. etc??

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...