So, I regex time from my splunk logs in form of (HH:MM:SS), and I am trying to build the report like
**index: _something_
| regex Time
| regex Date
| regex User
| stats list( (regex)Time) by (regex)Date, (regex)User**
Unfortunately, the list of (regex)Time is not showing up in orderly manner. How can I make this ordering in ascending manner?
Thanks in advance!
↧