So I wasn't really sure how to do this after reading the documentation, but I'm running the following search:
(host="web01.x.com") AND (source="/common/site-logs/x-activity.log") AND ("create" AND "project") NOT ("brief" OR "campaign" OR "proposal" OR "talentlist" OR "teamroom" OR "view" OR "criteria" OR "problem") | stats count by date_month
I get the data back that I want, however the months are in alphabetical order instead of by date. How can I sort these to be in date order with how they would go on a calendar?
Thanks in advance.
-Tyler
don't use the date_month field. They are unreliable. use
... | bucket _time span=1mon | stats count by _time
don't use the date_month field. They are unreliable. use
... | bucket _time span=1mon | stats count by _time
Great! Thank you!