Hi,
I have created a chart showing the cumulative sum of hours for each host for the month of August.
Here the fields are
Day Date In-Time Out-Time DurationHours(OutTime-InTime)
The query is :
sourcetype="abc" | convert mstime(Out_Time__) AS outtime | convert mstime(In_Time__) AS intime |eval durationHrs=(outtime - intime )/60 | streamstats sum(durationHrs) as cumulativeSum by host | timechart values(cumulativeSum) by host
Here it should show ,for aug1 cumulative sum is 8,for Aug2 ->19 .... aug31-->208.
Here in my case it is in a reverse order i.e., for aug1 its showing 208 and for aug31 it is 8.How this can be solved?
Thank You
Please include "|sort date_mday" or "|sort _time" before performing streamstats.
Hi somesoni2,
thank you for the solution and i also come up with the solution where i included "reverse" in the query i.e., sourcetype="abc" | reverse |.....