How to chart data in chronological order by day of the week, not alphabetically?

[halkelley]

can I chart data by day of the week, but have it come out chronologically instead of alphabetically?.. i.e. I want Sunday, Monday, Tuesday... instead of Friday, Monday, Saturday...

[somesoni2]

May be like this (without lookups)

source=Ipc.Recon.Web New merchant. Redirecting to SWC. ServiceKey: 1846869E3691300C, AppPid: 0F4633D95001300C NOT M66128 | dedup MPID | eval date_wday=strftime(_time,"%w-%A")| chart count AS auth.net BY date_wday | appendcols [search source=Ipc.Sync.Web New merchant. Redirecting to SWC. ServiceKey: 970A36376A11300C, AppPid: A476DC90C001300C | dedup MPID | eval date_wday=strftime(_time,"%w-%A")| chart count AS clover BY date_wday ]| eval date_wday=replace(date_wday,"(\d+-)(\w+)","\2")

[halkelley]

@somesoni2 that works great too...and don't need the lookup...thanks!

[newbie2tech]

thanks @somesoni2 ,date_wday=strftime(_time,"%w-%A") suggestion from your query helped crack my usecase

[strive · Accepted solution]

I think this is not the cleanest wat, but this should work. Have a CSV lookup for date_wday to day_number. After chart, do the lookup then the result will be 3 columns. Sort based on day_number and then ignore the day_number.

I will be eager to know if there is any clean way to get this done

[strive]

There is one more option, same as sort but without using external lookup. See example 5 in this link

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Sort

[halkelley]

@strive that worked!...thanks very much...a lot better than prefixing a 0-6 in front of every weekday name!

[ppablo]

@strive Thanks for chiming in. I was hoping you or another search guru would take a stab at it 😛 I definitely want to learn from the different solutions to this.

[halkelley]

it just seems if you chart By date_wday, you would want it to come out sunday, monday, tuesday, etc., and not the days alphabetically

[halkelley]

sorry it's kind of messy, but here it is:

source=Ipc.Recon.Web New merchant. Redirecting to SWC. ServiceKey: 1846869E3691300C, AppPid: 0F4633D95001300C NOT M66128 | dedup MPID | chart count AS auth.net BY date_wday | appendcols [search source=Ipc.Sync.Web New merchant. Redirecting to SWC. ServiceKey: 970A36376A11300C, AppPid: A476DC90C001300C | dedup MPID | chart count AS clover BY date_wday ]

[ppablo]

@halkelley

Would you be able to paste your current search you're using? This will make it easier for search experts to help figure out your issue and work from there 🙂

[halkelley]

yeah, the problem is I'm grouping all data into day of the week bins, so I have Sunday = cumulative data for every Sunday, etc.

[ppablo]

Hi @halkelley

Have you tried using the timechart command?
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Timechart