thank you for your hint. I was able to include this into my search, so last part in my case looks like this: host "server" sourcetype="access_combined"
... some eval stuff ...
| fields date_wday _time request_group
| search request_group!="other"
| bin _time span=1d
| stats count by date_wday,request_group,_time
| chart avg(count) as prumer by date_wday,request_group
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field sorting is based (coppied 🙂 ) from https://community.splunk.com/t5/Splunk-Search/Days-in-Alphabetical-Order-but-need-to-be-in-day-order-Tried/td-p/150403
... View more
