create a chart from a csv

[chadman]

I have a csv file that Splunk ingest and use it to create a chart. It works ok, but I'm not sure how to sort this by date since the data in the csv is not in a real date format. the csv looks like:

Month,Webcam,Speech
July-17,10566,1255
August-17,10612,1248
September-17,10703,1263
October-17,10770,1260
November-17,10872,1267

and this data goes back a few years. Is there a way I can still have it sort by the month/year in my chart? Currently have it sort by a count that so far as gone up. That works for now, but the number could go down and put the months out of order.

[LeeSart]

I'd suggest using strptime to convert the date field to epoch time, then sorting on the epoch field. The example below assumes that the field containing your date is called 'date':

base search | eval epoch=strptime(date, "%B-%y") | sort epoch

[elliotproebstel · Accepted solution]

I'd convert Month to a time field with a little bit of data massaging:
| eval time=strptime("01-".Month, "%d-%B-%y")

What I'm doing there is appending "01-" to the start of the month string before converting it withstrptime, because (to the best of my knowledge) strptime requires at least day, month, and year in order to create a valid timestamp. Since you only have one entry per month in your sample data, that should work fine. Then you can just sort based on the time field:
| sort - time

[chadman]

thanks, that worked.