date sorting numerically not alphabetically

[aaronkorn]

Hello,

We have the following search in a chart but the dates are sorting alphabetically rather than numerically. ie Aug 1, Aug 2, Jul 29, Jul 30 and not Jul 29, Jul 30, Aug 1, Aug 2.

index=reporter | dedup TKT_NUMBER | eval time=strftime(_time, "%b %d") | bucket time span=1d | chart count over NOTIFY_GROUP by time useother=f | rename NOTIFY_GROUP AS Group

[aaronkorn]

Thanks for your response. I tried the code but still not the result I was looking for:

[Ayn]

That's because you're sorting by an alphanumeric field - Splunk doesn't know what the string you're sorting by represents. It's a better idea to sort by _time but have it display as something more human readable.

index=reporter | dedup TKT_NUMBER | bucket _time span=1d | chart count over NOTIFY_GROUP by _time useother=f | rename NOTIFY_GROUP as GROUP | fieldformat _time=strftime(_time,"%b %d")