topic Re: How to format _time column to display only month name in Splunk Search

How to format _time column to display only month name

sudeep5689 — Mon, 08 Jun 2020 19:32:37 GMT

Hi i have a column _time getting displayed in the results due to timechart used in the query. Its currently getting displayed in the form of 03-2020 but i want to show it like March or Mar. Is there a way to do that?

Re: How to format _time column to display only month name

richgalloway — Thu, 28 May 2020 16:55:49 GMT

One of these should work. %B gives the full month name. Use %b for the abbreviated name.

... | fieldformat _time=strftime(_time, "%B")

... | eval _time = strftime(_time, "%B")

Re: How to format _time column to display only month name

sudeep5689 — Fri, 29 May 2020 10:04:13 GMT

Hi, the values looked fine in tabular view but in visualization it is causing error, Undefined NAN is coming on top of column chart

Re: How to format _time column to display only month name

richgalloway — Fri, 29 May 2020 13:00:23 GMT

"NAN" means "Not A Number", which is true for any month name.

It appears we have solved the specific problem, but there is a bigger problem which requires a solution. Please post a new question describing that problem.

Re: How to format _time column to display only month name

ankitsachdeva22 — Thu, 10 Nov 2022 12:29:55 GMT

Hii I've column Months getting displayed in the form of 03 but i want to show it like March or Mar. Is there way to do that....I used this result but it shows same result