I want to show data result group by month where data sorted as string not as date

[archanachaudhar]

In data, I have complete date time field , which is formatted in Month format then we added group by clause as below

eval Month = strftime(opdate,"%b %y")

| stats list(category) as category, list(incident) as no_of_inci, list(sum_tw) as sum_operation_time, list(eval(sum_tw/cnt_tw)) as "Average resolution time" by Month

Data is displayed

Month Category Number of incident Time avarage
Aprl 18 xyz 10 10 1
Aug 15 sdhshf 2 14 7
Dec 17 ... ....

I want result should be

Month Category Number of incident Time avarage
Aug 15 sdhshf 2 14 7
Dec 17 ... ....
Aprl 18 xyz 10 10 1

[richgalloway]

You should be able to sort by the original timestamp field if you include it in the stats command. Use the fields command to hide opdate after sorting.

| stats list(category) as category, list(incident) as no_of_inci, list(sum_tw) as sum_operation_time, list(eval(sum_tw/cnt_tw)) as "Average resolution time" values(opdate) by Month | sort + opdate | fields - opdate

[cmerriman]

I agree with @richgalloway , however, maybe not use values(opdate) as you'll get every single unique timestamp from opdate. perhaps use max(opdate) or min(opdate) to get the or earliest/latest to get just one of the dates within the Month and sort by that.