Splunk Search

monthly Chronology order.

Path Finder

HI All,

am having trouble getting below table in monthly order. please help me in this. 

Query : 

 

 index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%b-%y") 
| chart count over Class_Type by month_Year 

 

 

Output tabular format : 

Class_TypeAug-20Jul-20Sep-20
NodeDown 216822492027

 

 

 

Please help in chronology order

Labels (5)
0 Karma
1 Solution

Builder

Try this

index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column

View solution in original post

0 Karma

Builder

Try this

index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column

View solution in original post

0 Karma

Explorer

Changing the %b (Abbreviated month name. (Jan, Feb, etc.)) to %m (Month as a decimal number. (01 to 12).) would give you 07-20, 08-20 and 09-20 instead.
That way the sort would be in monthly order

index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%m-%y") 
| chart count over Class_Type by month_Year 
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!