My search showing alphabetic order in months(like chart is in this order (dec,feb,jan, nov)
Can someone please help me on this ?
You can use the fieldformat
command to retain numeric sort order, while changing how a field's value is displayed. You will need to rewrite your search, e.g."
<search>
| eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m")
| fieldformat month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b")
| chart sum(lsCDR_duration) as Duration(in sec) over month
You can use the fieldformat
command to retain numeric sort order, while changing how a field's value is displayed. You will need to rewrite your search, e.g."
<search>
| eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m")
| fieldformat month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b")
| chart sum(lsCDR_duration) as Duration(in sec) over month
<search> | eval _month_num=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m") | eval month=strftime(lsCDR_endTime,"%Y-%m-%d"),"%b") | stats sum(lsCDR_duration) as "Duration(in sec)" by _month_num,month | sort _month_num
How about
which gives the month as a decimal number instead of the name of the month.
but I want to show as month name in output