I have on field named average duration which is right now sorting alphabetically.
Are there any way we can sort it by month,day ,hours and minutes then in numerical order??
Try this!
<your search>|table Name "Average duration"
|rex field="Average duration" "(?<val>\d+\.?\d+)\s(?<unit>\w+)"
|evalmultiplier=case(unit=="seconds",1,unit="minutes",60,unit=="hrs",3600,unit=="days",86400,unit="months",2592000)
|eval durseconds=(val*multiplier)
|sort -durseconds|fields Name "Average duration"
Try this:
| eval month_num=strftime(_time,"%m") | eval Month=date_mday."-".date_month."-".date_year."-".date_hour.":".date_minute | stats count by month_num,Month date_hour date_mday date_minute | sort - limit=0 month_num date_mday date_hour date_minute
Thanks for your reply!!
But there is only one field that is having the average count for every person .I want a logic for that kind of sorting.
Can you post some example data?
What format are the values in?
Name Average duration
X 1.4 hrs
Y 6.2 minutes
Z 2.9 days
XY 20 days
YZ 22minutes
A 1.2 months
Something like this.Since its confidential so can't post the original .SO sample one I am posting
this is your input data right?
and what output you want?
This is the input .I want output like .
While ascending
Y 6.2 minutes
YZ 22minutes
X 1.4 hrs
Z 2.9 days
XY 20 days
A 1.2 months
Descending
A 1.2 months
XY 20 days
Z 2.9 days
X 1.4 hrs
YZ 22minutes
Y 6.2 minutes
hmm... yuk!
probably just a formatting error - but can you confirm there is always a space between the number and the unit.
Also, is it hrs, or hours?