Try this I am assuming your date is coming in a field myField
yourQuery to return myField
| eval newTime="00:00:00 01-".myField
| eval monthYear=strptime(newTime,"%H:%M:%S %d-%b-%y")
| fieldformat monthYear=strftime(monthYear, "%b-%y")
| table myField, monthYear
| sort monthYear
Try to replace last line | sort monthYear
with | sort myField
and see the difference.
How about converting for sorting?
・・・|eval sort_field=strptime(text_date,"%b-%d")|sort sort_field|fields - sort_field
Hey Horishi,
This is not working.. First of all strptime is not returning any data.
eval text_date="Aug-16" | eval sort_field=strptime(text_date,"%b-%d")|sort sort_field|fields - sort_field | table sort_field
I am deleting the sort_field .
|fields - sort_field | table sort_field
↓
| table sort_field
Still the Sort is not working..
eval a=strftime(strptime(Approval_Month,"%b-%d"), "%b-%y") | table a | sort a
I mistook the day and the year.
eval a=strftime(strptime(Approval_Month,"%b-%d"), "%b-%y") | table a | sort a
↓
eval wk_Approval_Month="00:00:00:01-"+Approval_Month|eval a=strftime(strptime(wk_Approval_Month,"%H:%M:%S:%d-%b-%y"),"%Y-%m") | sort a
※a=2016-08