Need your help,
We have column charts with the below query and its working fine,
index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" |timechart sum(PAGE_VIEWS) as PageViews span=1mon
its showing as
2013-Jan, Feb...2014-Jan,Feb....2015-Jan,Feb
but there is requirement to show data in this order,
Jan-2013,Jan-2014,Jan-2015,Feb-2014,Feb-2014,Feb-2015
Can you please help us to write this query
Currently you're getting a timechart with field _time (epoch) and PageViews, with results sorted ascending order of _time. Try something like this
index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" |timechart sum(PAGE_VIEWS) as PageViews span=1mon | eval Timestamp=strftime(_time,"%m-%Y-%b-%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,8)
Do it like this:
index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" | bucket _time span=1m | chart sum(PAGE_VIEWS) as PageViews by _time | eval myTime = strftime(_time, "%m-%y") | sort myTime | fields myTime PageViews | fields - _time
Currently you're getting a timechart with field _time (epoch) and PageViews, with results sorted ascending order of _time. Try something like this
index="myindex" source="/opt/apps/data/views/app_PV_UV_Data_3.csv" |timechart sum(PAGE_VIEWS) as PageViews span=1mon | eval Timestamp=strftime(_time,"%m-%Y-%b-%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,8)
Thank you so much, its working fine, can you please give me the query with out hyphen (-jan-2013) in the beginning.
i just adjusted the query and it works. Thank you,
eval Timestamp=substr(Timestamp,9)