monthly Chronology order.

[jerinvarghese]

HI All,

am having trouble getting below table in monthly order. please help me in this. 

Query : 

 index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%b-%y") 
| chart count over Class_Type by month_Year 

Output tabular format : 

Class_Type	Aug-20	Jul-20	Sep-20
NodeDown	2168	2249	2027

Please help in chronology order

[ITWhisperer · Accepted solution]

Try this

index=moogsoft_e2e
| bin span=1mon _time
| stats count by Class_type _time
| xyseries Class_type _time count
| transpose 0
| eval column=if(column!="Class_type",strftime(column,"%b-%y"),column)
| transpose 0 header_field=column
| fields - column

[erikwie]

Changing the %b (Abbreviated month name. (Jan, Feb, etc.)) to %m (Month as a decimal number. (01 to 12).) would give you 07-20, 08-20 and 09-20 instead.
That way the sort would be in monthly order

index=moogsoft_e2e 
| bin span=1mon _time 
| eval month_Year = strftime(_time,"%m-%y") 
| chart count over Class_Type by month_Year