How do you convert a month number to a month string?

[sph0lt0n]

Some timestamps use month numbers like "11" rather than strings like "Nov".

I'm using this eval to make the conversion:

| eval month=if(isnotnull(MM),if(MM="01","Jan",if(MM="02","Feb",if(MM="03","Mar",if(MM="04","Apr",if(MM="05","May",if(MM="06","Jun",if(MM="07","Jul",if(MM="08","Aug",if(MM="09","Sep",if(MM="10","Oct",if(MM="11","Nov",if(MM="12","Dec","INV")))))))))))),MM)

Is there a better way?

[sduff_splunk]

If you have a timestamp you can work with

| eval month=strftime(_time,"%b")

Otherwise, you could tidy up the if statement by using a case statement instead

| eval month=case(
MM="01","Jan",
MM="02","Feb",
MM="03","Mar",
MM="04","Apr",
MM="05","May",
MM="06","Jun",
MM="07","Jul",
MM="08","Aug",
MM="09","Sep",
MM="10","Oct",
MM="11","Nov",
MM="12","Dec",
1=1, "INV")