@dtburrows3
this query showing date &time haphazardly, how to sort it like 1/4/2024, 1/3/2024, 1/2/2024....
index="*" source="*" |eval
timestamp=strftime(_time, "%m/%d/%Y")
| chart limit=30
count as count
over DFOINTERFACE
by timestamp
Assuming that your events have proper timestamps extracted to the _time field you should be able to do this.
source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log"
| timechart limit=30 span=1d
count as count
by DFOINTERFACE
Hi @dtburrows3
its giving different result. I just want in reverse direction
its giving me like this :
but I want like this
You can try this to get the report in that format.
Edit: Noticed that the chart method could mess up the order of dates from left to right so I think sorting first and then doing a transpose should fix it.
source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log"
| timechart span=1d limit=30
count as count
by DFOINTERFACE
| sort 0 +_time
| eval
timestamp=strftime(_time, "%m/%d/%Y")
| fields + timestamp, *
| fields - _*
| transpose 30 header_field=timestamp
| rename
column as "DFOINTERFACE \ Date"
Example from my local instance.
thank you very much