Hi
search command "bucket" time sorting?
My search commmand
* | bucket _time span=1d | eval time=strftime(_time,"%y. %m. %d") | stats ~ | sort -time
(year.month.day)
=> 11.12.11 - - - - - - - - - - - -
=> 11.12.12 - - - - - - - - - - - -
=> 11.12.13 - - - - - - - - - - - -
=> 11.12.14 - - - - - - - - - - - -
. - - - - - - - - - - - -
. - - - - - - - - - - - -
But I want search result is
(year.month.day)
=> 11.12.16 - - - - - - - - - - - -
=> 11.12.15 - - - - - - - - - - - -
=> 11.12.14 - - - - - - - - - - - -
Please answer.
thanks
I don't see what you're doing in the stats command? Anyway, you will probably want to put the eval
after you created the stats.
* | bucket _time span=1d | stats count by _time | eval time=strftime(_time,"%y. %m. %d") | sort -_time | table time count