converting date string "d/mm/yyyy" into "d/mm/yyyy" that can be ordered correctly.
I have a column with a Date in string format "1/01/2011" (d/mm/yyyy), but when I sort this column by date it does not work as it is in a string format.
this is what I get:
1/01/2011
1/01/2012
1/01/2013
1/01/2014
1/01/2015
1/01/2016
1/02/2011
1/02/2012
1/02/2013
1/02/2014
1/02/2015
1/02/2016
Is there a way to do an eval
on this column, or other way, and correct this?
This is what I want:
1/01/2011
2/01/2011
3/01/2011
4/01/2011
...
NOTE: I basically have a csv file that I am importing and this is the format it appears in splunk when it is imported.
If the dates you are trying to sort are properly represented by _time you can sort by _time then eval after sorting:
your search | sort _time | eval Date=...
tks vm this is what done it for me
to help me understand whats going on:
... | eval Date2=strptime(Date, "%d/%m/%Y") | sort Date2 | eval Date3=strftime(Date2, "%d/%m/%Y")
the same as above but with out extra columns:
... | eval Date=strptime(Date, "%d/%m/%Y") | sort Date | eval Date=strftime(Date, "%d/%m/%Y")