topic Convert month field from csv in different format? in Splunk Search

Convert month field from csv in different format?

pgadhari — Tue, 03 Nov 2020 10:10:55 GMT

My csv file has "month" field and the values are as below :

2020-10 2020-09 2020-08 2020-07 2020-06 2020-05 2020-04 2020-03 2020-02 2020-01

I want to convert the months from number to Jan, Feb, Mar, Apr and so on... I tried using strptime, but that is not working. I want to show it as 2020-Jan, 2020-Feb, 2020-Mar...

Please help , below is my query :

index=azure sourcetype=azure_total_cost source="C:\total_cost\\azure_total_cost_by_year.csv" month!="month" | eval mymonth=strftime(month, "%Y-%b")

Re: Convert month field from csv in different format?

renjith_nair — Tue, 03 Nov 2020 11:28:34 GMT

Add a dummy "day" to the month and try converting it

|makeresults|eval month="2020-10"|eval nMonth=month."-01"|eval formattedMonth=strftime(strptime(nMonth,"%Y-%m-%d"),"%Y-%b")

Re: Convert month field from csv in different format?

pgadhari — Tue, 03 Nov 2020 12:24:06 GMT

Yes @renjith_nair . I am able to resolve the issue with the above query. Thank you very much for immediate respnose.