data is displayed by alphabetic order of the month name when using date_month to sort

[zliu]

In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is displayed by alphabetic order of the month name.

Data is displayed by alphabetic order of the month name when it should be logical.

* |stats count as "Total Incident/month" by date_month 

[ag]

I would change something slightly with gkanapathy's answer. Prefix the date_numeric_month with an underscore to make it hidden and add the month name within the query.

In this example I am getting the count of user_ids per month:

... | eval _date_numeric_month=strftime(_time,"%m") | stats count(user_id) by _date_numeric_month, date_month | sort _date_numeric_month

[gkanapathy]

This is not a bug. If you do want to sort by month, then you can place the month number in a field and sort on that, e.g.:

... | eval date_numericmonth=strftime(_time,"%m") | stats count by date_numericmonth

[lakshayanand]

what if i want to use chart command instead of stats. then how do i arrange months in chronological order?
Below is the query in which i want to arrange results by chronological order:
.
.....| eval month=strftime(strptime(UpdateDate,"%m/%d/%y %H:%M"),"%B")| chart sum(Effort) by month,date_year | sort month

[zliu]

This is a bug. Bug#SPL-43691