https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576755#M10849 <P>need help on eval function of trimming the month&nbsp;</P><P>EX : April = APR&nbsp;</P><P>all months first 3 letters&nbsp;</P><P>thanks&nbsp;</P><P>&nbsp;</P> Tue, 30 Nov 2021 12:49:25 GMT shreyasamin64 2021-11-30T12:49:25Z https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576755#M10849 <P>need help on eval function of trimming the month&nbsp;</P><P>EX : April = APR&nbsp;</P><P>all months first 3 letters&nbsp;</P><P>thanks&nbsp;</P><P>&nbsp;</P> Tue, 30 Nov 2021 12:49:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576755#M10849 shreyasamin64 2021-11-30T12:49:25Z https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576758#M10850 <LI-CODE lang="markup">| eval month=substr(month,1,3)</LI-CODE> Tue, 30 Nov 2021 13:12:21 GMT https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576758#M10850 ITWhisperer 2021-11-30T13:12:21Z https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576856#M10852 <LI-CODE lang="markup">| makeresults | eval months="January February March April May June July August September October November December" | makemv delim=" " months | mvexpand months | eval short-month=upper(substr(months,1,3)) | fields - _time</LI-CODE><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Gr0und_Z3r0_0-1638346164590.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17073iE3D0535D2085B2E0/image-size/medium?v=v2&amp;px=400" role="button" title="Gr0und_Z3r0_0-1638346164590.png" alt="Gr0und_Z3r0_0-1638346164590.png" /></span></P><P>&nbsp;</P> Wed, 01 Dec 2021 08:09:36 GMT https://community.splunk.com/t5/Splunk-Enterprise/eval-function/m-p/576856#M10852 Gr0und_Z3r0 2021-12-01T08:09:36Z