https://community.splunk.com/t5/Splunk-Search/Grouping-by-month-instead-of-by-full-date-format/m-p/437183#M124513 <P>Hi guys,<BR /> Currently, my data is grouped like this:</P> <PRE><CODE>1. Product | 2018-5-5 02:00 | 2018-5-5 02:30 | 2018-5-5 04:00 | 2018-6-5 02:00 2. asdf | 5 | 6 | 7 | 5 </CODE></PRE> <P>I want to change my data such that it will group by month</P> <PRE><CODE>1. Product | 2018-5 | 2018-6 2. asdf | 18 | 5 </CODE></PRE> <P>..<BR /> This is my code:</P> <PRE><CODE>index=asdf |chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name month </CODE></PRE> <P>Helpp..</P> Fri, 13 Jul 2018 07:53:29 GMT andrehl 2018-07-13T07:53:29Z https://community.splunk.com/t5/Splunk-Search/Grouping-by-month-instead-of-by-full-date-format/m-p/437183#M124513 <P>Hi guys,<BR /> Currently, my data is grouped like this:</P> <PRE><CODE>1. Product | 2018-5-5 02:00 | 2018-5-5 02:30 | 2018-5-5 04:00 | 2018-6-5 02:00 2. asdf | 5 | 6 | 7 | 5 </CODE></PRE> <P>I want to change my data such that it will group by month</P> <PRE><CODE>1. Product | 2018-5 | 2018-6 2. asdf | 18 | 5 </CODE></PRE> <P>..<BR /> This is my code:</P> <PRE><CODE>index=asdf |chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name month </CODE></PRE> <P>Helpp..</P> Fri, 13 Jul 2018 07:53:29 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-by-month-instead-of-by-full-date-format/m-p/437183#M124513 andrehl 2018-07-13T07:53:29Z https://community.splunk.com/t5/Splunk-Search/Grouping-by-month-instead-of-by-full-date-format/m-p/437184#M124514 <P>Hi,</P> <P>You need to create a dummy field to get year and month.</P> <PRE><CODE>| eval yearMonth=date_year."-".date_month |chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name yearMonth </CODE></PRE> Fri, 13 Jul 2018 12:57:00 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-by-month-instead-of-by-full-date-format/m-p/437184#M124514 thambisetty 2018-07-13T12:57:00Z