Splunk Search

How to edit my search to sort dates in calendar order?

uhkc777
Explorer

Here is my search:

index=parmed-qa date_wday=monday |table _time date_month date_wday date_mday orderid|sort 0 _time|eval day_month=date_mday+"_"+date_month|chart count(orderid) by  day_month date_wday limit=0|

1_august 8
4_july 1
11_july 7
15_august 8
18_july 4
22_august 11
25_july 4

I want to get all those dates are in calendar order.

0 Karma

sundareshr
Legend

Try this

index=parmed-qa date_wday=monday | timechart count(orderid) as count | eval day_month=strftime(_time, "%d_%B")  
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...