Splunk search for each month

[jerinvarghese]

HI All,

Need help in preparing a tabular form.

Data am having : 

using the Index am getting below table.

Class	Count
NODEDOWN	520
BGPDOWN	320
ISISALERT	130

Query am using

index=itsm
stats count by Class

Last 60 days data.

Requirement: 

I want month wise data. I used timewrap and timechart.  But the data am getting is not the correct format.

Expected format output.

Class	Jul-20	Aug-20	Sep-20
NODEDOWN	250	250	20
BGPDOWN	150	150	20
ISISALERT	50	50	30

Please help me this format, 

If it search for 1 year data. all 12 months in tabular data.

[thambisetty · Accepted solution]

index=itsm
| bin span=1mon _time
| eval month_Year = strftime(_time,"%b-%y")
| chart count over Class by month_Year

[jerinvarghese]

HI, 

My order is coming as below. how can i make it on order.

I tried above qury and that provides me output, but all the order is in alphabetical order not in the month wise order. its not useful data. Please help me get it in month wise order

Class	Aug-20	Jul-20	Sep-20
NODEDOWN	200	200	20