issue regarding date_wday

[elaine0102]

| stats count by date_wday |

Hi all, above return me Friday, Monday, Saturday, Sunday, Thursday, Tuesday, Wednesday.

How can I make it to display : Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday ?

[gkanapathy]

It would be a lot better to do:

... | timechart span=1d count by _time

or

... | bucket span=1d _time | stats count by _time

[sdaniels]

The first thing you'll use is time modifiers depending on when you are searching. For example earliest=@w1 would snap to Monday of the current week. Check it out because depending on when you do the search you'll want to control what days you are looking at.

http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers

There is an example in the docs specific to handling days of the week. Just a simple | sort -date_wday doesn't work since that will just sort alphabetically.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort

... | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field