| stats count by date_wday |
Hi all, above return me Friday, Monday, Saturday, Sunday, Thursday, Tuesday, Wednesday.
How can I make it to display : Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday ?
It would be a lot better to do:
... | timechart span=1d count by _time
or
... | bucket span=1d _time | stats count by _time
The first thing you'll use is time modifiers depending on when you are searching. For example earliest=@w1 would snap to Monday of the current week. Check it out because depending on when you do the search you'll want to control what days you are looking at.
http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/SearchTimeModifiers
There is an example in the docs specific to handling days of the week. Just a simple | sort -date_wday doesn't work since that will just sort alphabetically.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort
... | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field