Splunk Search

monthly Chronology order.

Path Finder

HI All,

am having trouble getting below table in monthly order. please help me in this. 

Query : 

 

 index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%b-%y") 
| chart count over Class_Type by month_Year 

 

 

Output tabular format : 

Class_TypeAug-20Jul-20Sep-20
NodeDown 216822492027

 

 

 

Please help in chronology order

Labels (5)
0 Karma
1 Solution

Communicator

Try this

index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column

View solution in original post

0 Karma

Communicator

Try this

index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column

View solution in original post

0 Karma

Explorer

Changing the %b (Abbreviated month name. (Jan, Feb, etc.)) to %m (Month as a decimal number. (01 to 12).) would give you 07-20, 08-20 and 09-20 instead.
That way the sort would be in monthly order

index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%m-%y") 
| chart count over Class_Type by month_Year 
0 Karma