Dashboards & Visualizations

Reporting / Dashboard issues

magneto417x
New Member

So I am using the following search to grab data:

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | streamstats avg(daycount) |

Issue I noticed today when looking at month to date it orders result in below order which also messes up bar chart any suggestions to fix would be much appreciated.

1
10
2
3
4
5
6
7
8
9

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

Quick note, I am not entirely sure what you are doing with the eval Time ... step because that doesn't have any effect.

Regadless, you can fix your sorting problem by adding a leading zero to date_mday. Add this to your search for ascending calendar dates..

| eval date_mday = if(date_mday < 10, "0".tostring(date_mday), tostring(date_mday)) | sort +date_mday

View solution in original post

0 Karma

puneethgowda
Communicator

eval Time=strftime(_time,"%b %Y")

You are not using eval for any results.

My suggestion is to make use of strftime

Like below

eval datemday=strftime(_time,????)

Give the required format

And count by datemday

You can also use raw date column instead of _tim because daylight matters

0 Karma

magneto417x
New Member

I'm not sure I understand that would make my search be then I tried it a few times and it fails. Would you be able to post what the complete statement would look like?

0 Karma

puneethgowda
Communicator

Sleeping time in India now let me try tomorrow

0 Karma

rjthibod
Champion

Quick note, I am not entirely sure what you are doing with the eval Time ... step because that doesn't have any effect.

Regadless, you can fix your sorting problem by adding a leading zero to date_mday. Add this to your search for ascending calendar dates..

| eval date_mday = if(date_mday < 10, "0".tostring(date_mday), tostring(date_mday)) | sort +date_mday

0 Karma

rjthibod
Champion

@magneto417X Did you try my suggestion of prepending the 0 to some dates?

0 Karma

magneto417x
New Member

That worked. Thanks 🙂

0 Karma

magneto417x
New Member

Not yet had to go to a meeting but plan to give it a spin when I'm back. I will try and update thread 🙂

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

source="mhn-splunk.log" |eval Time=strftime(_time,"%b %Y") | stats count as daycount by date_mday | sort 0 num(date_mday) | streamstats avg(daycount) 
0 Karma

magneto417x
New Member

The returns same results and still not in order 😞

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That works for me for similar query. Did you use the exact query I gave or there was any modification. Give @rjthibod's answer a try then.

0 Karma

magneto417x
New Member

Copied the query and ran it and it failed 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...