Splunk Search

data is displayed by alphabetic order of the month name when using date_month to sort

zliu
Splunk Employee
Splunk Employee

In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is displayed by alphabetic order of the month name.

Data is displayed by alphabetic order of the month name when it should be logical.

* |stats count as "Total Incident/month" by date_month 

alt text

Tags (1)

ag
Explorer

I would change something slightly with gkanapathy's answer. Prefix the date_numeric_month with an underscore to make it hidden and add the month name within the query.

In this example I am getting the count of user_ids per month:

... | eval _date_numeric_month=strftime(_time,"%m") | stats count(user_id) by _date_numeric_month, date_month | sort _date_numeric_month

gkanapathy
Splunk Employee
Splunk Employee

This is not a bug. If you do want to sort by month, then you can place the month number in a field and sort on that, e.g.:

... | eval date_numericmonth=strftime(_time,"%m") | stats count by date_numericmonth

lakshayanand
New Member

what if i want to use chart command instead of stats. then how do i arrange months in chronological order?
Below is the query in which i want to arrange results by chronological order:
.
.....| eval month=strftime(strptime(UpdateDate,"%m/%d/%y %H:%M"),"%B")| chart sum(Effort) by month,date_year | sort month

0 Karma

zliu
Splunk Employee
Splunk Employee

This is a bug. Bug#SPL-43691

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...