Splunk last 7 days within current month?

[splunkreal]

Hello,

I'm using dd/mm/yyyy date format and results are not correctly sorted if we are dealing with data across months.

I've tried https://answers.splunk.com/answers/215005/sorting-date-1.html but it doesn't work. The only right way is to use %Y/%m/%d

Otherwise, is it possible to limit the results to the current month?

Snapshot attached.

Thanks.

[sundareshr · Accepted solution]

Try this instead

index=* | rex ... | rex ... | where ... | timechart span=1d count as visits | eval Date=strftime(_time, "%d/%m/%Y") | fields - _time

And if you only want first 7, you can either filter the data to return only the days you want or add head 7 OR tail 7 to the end

[splunkreal]

Thanks, it works with timechart.

[ddrillic]

You should sort by _time and not by the alphanumeric date field.