Splunk Search

Search showing time in months in alphabetic order

kml_uvce
Builder

My search showing alphabetic order in months(like chart is in this order (dec,feb,jan, nov)

|eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b") | chart sum(lsCDR_duration) as Duration(in sec) over month

Can someone please help me on this ?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can use the fieldformat command to retain numeric sort order, while changing how a field's value is displayed. You will need to rewrite your search, e.g."

<search> 
 | eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m")
 | fieldformat month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b")
 | chart sum(lsCDR_duration) as Duration(in sec) over month

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can use the fieldformat command to retain numeric sort order, while changing how a field's value is displayed. You will need to rewrite your search, e.g."

<search> 
 | eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m")
 | fieldformat month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%b")
 | chart sum(lsCDR_duration) as Duration(in sec) over month

Ayn
Legend
<search> | eval _month_num=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m") | eval month=strftime(lsCDR_endTime,"%Y-%m-%d"),"%b") | stats sum(lsCDR_duration) as "Duration(in sec)" by _month_num,month | sort _month_num
0 Karma

lguinn2
Legend

How about

| eval month=strftime(strptime(lsCDR_endTime,"%Y-%m-%d"),"%m") | chart sum(lsCDR_duration) as "Duration(in sec)" over month

which gives the month as a decimal number instead of the name of the month.

0 Karma

kml_uvce
Builder

but I want to show as month name in output

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...