HI All,
am having trouble getting below table in monthly order. please help me in this.
Query :
index=moogsoft_e2e
| bin span=1mon _time
| eval month_Year = strftime(_time,"%b-%y")
| chart count over Class_Type by month_Year
Output tabular format :
Class_Type | Aug-20 | Jul-20 | Sep-20 |
NodeDown | 2168 | 2249 | 2027 |
Please help in chronology order
Try this
index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column
Try this
index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column
Changing the %b (Abbreviated month name. (Jan, Feb, etc.)) to %m (Month as a decimal number. (01 to 12).) would give you 07-20, 08-20 and 09-20 instead.
That way the sort would be in monthly order
index=moogsoft_e2e
| bin span=1mon _time
| eval month_Year = strftime(_time,"%m-%y")
| chart count over Class_Type by month_Year