https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467153#M131475 <P><CODE>date_month</CODE> field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in <CODE>date_month</CODE> field.</P> Fri, 29 May 2020 10:41:52 GMT 493669 2020-05-29T10:41:52Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467150#M131472 <P>I have a query with time range <STRONG>earliest</STRONG>=-2mon@mon <STRONG>latest</STRONG>=-1mon@mon . Now can i store the result as the month name which comes between earliest and latest ? E.g., for above example its should be March</P> Mon, 08 Jun 2020 19:37:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467150#M131472 sudeep5689 2020-06-08T19:37:59Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467151#M131473 <P>@sudeep5689 since <CODE>date_month</CODE> field is coming in your data it should have your expected month value</P> Fri, 29 May 2020 10:27:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467151#M131473 493669 2020-05-29T10:27:11Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467152#M131474 <P>Yes thats worked but its showing the month name as march, april. Can we format it to show as April and March. Please add your solution as the answer</P> Fri, 29 May 2020 10:36:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467152#M131474 sudeep5689 2020-05-29T10:36:57Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467153#M131475 <P><CODE>date_month</CODE> field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in <CODE>date_month</CODE> field.</P> Fri, 29 May 2020 10:41:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467153#M131475 493669 2020-05-29T10:41:52Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467154#M131476 <P>Its coming fine . Just its like there are two rows coming as april and march. I want to show them like April March, first letter in caps</P> Fri, 29 May 2020 10:47:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467154#M131476 sudeep5689 2020-05-29T10:47:33Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467155#M131477 <P>Try below to capital first letter of month</P> <PRE><CODE>... | eval date_month = upper(substr(date_month,1,1)).substr(date_month,2) </CODE></PRE> Fri, 29 May 2020 11:00:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467155#M131477 493669 2020-05-29T11:00:03Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467156#M131478 <P>Ok 1 more issue that o/p shows April first and then March, is there a way to show March first and then April. This o/p is coming from two queries appended together. My objective is to show a month wise comparison starting from March to April etc. and so on</P> Fri, 29 May 2020 11:09:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467156#M131478 sudeep5689 2020-05-29T11:09:15Z https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467157#M131479 <P>you may try-</P> <PRE><CODE>|sort 0 - date_month </CODE></PRE> <P>OR</P> <PRE><CODE>|sort 0 - _time </CODE></PRE> Sat, 30 May 2020 09:48:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-format-output-of-a-query/m-p/467157#M131479 493669 2020-05-30T09:48:12Z