search command "bucket" time sorting

[khyoung7410]

Hi

search command "bucket" time sorting?

My search commmand

* | bucket _time span=1d | eval time=strftime(_time,"%y. %m. %d") | stats ~ | sort -time

• search result

  (year.month.day)

  => 11.12.11 - - - - - - - - - - - -

  => 11.12.12 - - - - - - - - - - - -

  => 11.12.13 - - - - - - - - - - - -

  => 11.12.14 - - - - - - - - - - - -

  . - - - - - - - - - - - -

  . - - - - - - - - - - - -

But I want search result is

(year.month.day)

=> 11.12.16 - - - - - - - - - - - -

=> 11.12.15 - - - - - - - - - - - -

=> 11.12.14 - - - - - - - - - - - -

Please answer.

thanks

[Ayn]

I don't see what you're doing in the stats command? Anyway, you will probably want to put the eval after you created the stats.

* | bucket _time span=1d | stats count by _time | eval time=strftime(_time,"%y. %m. %d") | sort -_time | table time count