Splunk Search

date sorting numerically not alphabetically

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We have the following search in a chart but the dates are sorting alphabetically rather than numerically. ie Aug 1, Aug 2, Jul 29, Jul 30 and not Jul 29, Jul 30, Aug 1, Aug 2.

index=reporter | dedup TKT_NUMBER | eval time=strftime(_time, "%b %d") | bucket time span=1d | chart count over NOTIFY_GROUP by time useother=f | rename NOTIFY_GROUP AS Group

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Thanks for your response. I tried the code but still not the result I was looking for: alt text

0 Karma

Ayn
Legend

That's because you're sorting by an alphanumeric field - Splunk doesn't know what the string you're sorting by represents. It's a better idea to sort by _time but have it display as something more human readable.

index=reporter | dedup TKT_NUMBER | bucket _time span=1d | chart count over NOTIFY_GROUP by _time useother=f | rename NOTIFY_GROUP as GROUP | fieldformat _time=strftime(_time,"%b %d")
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...