Here is my query
index="myIndex" AND host="myHost" AND ObjectName="myObjectName"
| eval secondsEpoch = GroupDateTime/1000
| eval displayDate=strftime(secondsEpoch,"%m-%d %H:%M")
| chart sum(RecordCount) over CallingClass by displayDate
| sort 0 -GroupDateTime
GroupDateTime is a time that I am logging to splunk it contains an epoch time in milliseconds.
No matter how I sort my data it comes out looking like this. What I want is the latest date on the left column. I have even tried to chart by CallingClass over GroupDateTime and that doesn't work either. I even tried _time.
I have tried for several days to get this to work and can't find a solutions. I suspect it is probably something easy.
I am new to splunk so some solutions I didn't understand or couldn't get to work.
... View more