Splunk Search

data is displayed by alphabetic order of the month name when using date_month to sort

zliu
Splunk Employee
Splunk Employee

In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is displayed by alphabetic order of the month name.

Data is displayed by alphabetic order of the month name when it should be logical.

* |stats count as "Total Incident/month" by date_month 

alt text

Tags (1)

ag
Explorer

I would change something slightly with gkanapathy's answer. Prefix the date_numeric_month with an underscore to make it hidden and add the month name within the query.

In this example I am getting the count of user_ids per month:

... | eval _date_numeric_month=strftime(_time,"%m") | stats count(user_id) by _date_numeric_month, date_month | sort _date_numeric_month

gkanapathy
Splunk Employee
Splunk Employee

This is not a bug. If you do want to sort by month, then you can place the month number in a field and sort on that, e.g.:

... | eval date_numericmonth=strftime(_time,"%m") | stats count by date_numericmonth

lakshayanand
New Member

what if i want to use chart command instead of stats. then how do i arrange months in chronological order?
Below is the query in which i want to arrange results by chronological order:
.
.....| eval month=strftime(strptime(UpdateDate,"%m/%d/%y %H:%M"),"%B")| chart sum(Effort) by month,date_year | sort month

0 Karma

zliu
Splunk Employee
Splunk Employee

This is a bug. Bug#SPL-43691

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...