In data, I have complete date time field , which is formatted in Month format then we added group by clause as below
eval Month = strftime(opdate,"%b %y")
| stats list(category) as category, list(incident) as no_of_inci, list(sum_tw) as sum_operation_time, list(eval(sum_tw/cnt_tw)) as "Average resolution time" by Month
Data is displayed
Month Category Number of incident Time avarage
Aprl 18 xyz 10 10 1
Aug 15 sdhshf 2 14 7
Dec 17 ... ....
I want result should be
Month Category Number of incident Time avarage
Aug 15 sdhshf 2 14 7
Dec 17 ... ....
Aprl 18 xyz 10 10 1
You should be able to sort by the original timestamp field if you include it in the stats
command. Use the fields
command to hide opdate after sorting.
| stats list(category) as category, list(incident) as no_of_inci, list(sum_tw) as sum_operation_time, list(eval(sum_tw/cnt_tw)) as "Average resolution time" values(opdate) by Month | sort + opdate | fields - opdate
I agree with @richgalloway , however, maybe not use values(opdate)
as you'll get every single unique timestamp from opdate. perhaps use max(opdate)
or min(opdate)
to get the or earliest
/latest
to get just one of the dates within the Month and sort by that.