how to sort column chart based on month-year order

[dhavamanis]

Need your help,

We have column charts with the below query and its working fine,

index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" |timechart sum(PAGE_VIEWS) as PageViews span=1mon

its showing as

2013-Jan, Feb...2014-Jan,Feb....2015-Jan,Feb

but there is requirement to show data in this order,

Jan-2013,Jan-2014,Jan-2015,Feb-2014,Feb-2014,Feb-2015

Can you please help us to write this query

[woodcock]

Do it like this:

index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" | bucket _time span=1m | chart sum(PAGE_VIEWS) as PageViews by _time | eval myTime = strftime(_time, "%m-%y") | sort myTime | fields myTime PageViews | fields - _time

[somesoni2 · Accepted solution]

Currently you're getting a timechart with field _time (epoch) and PageViews, with results sorted ascending order of _time. Try something like this

 index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" |timechart sum(PAGE_VIEWS) as PageViews span=1mon | eval Timestamp=strftime(_time,"%m-%Y-%b-%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,8)

[dhavamanis]

Thank you so much, its working fine, can you please give me the query with out hyphen (-jan-2013) in the beginning.

[dhavamanis]

i just adjusted the query and it works. Thank you,

eval Timestamp=substr(Timestamp,9)