i have one dropdown with month and year how can i separate and make 2 dropdown , one for month another one for year
my query is this
| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"
| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y %b")
| dedup new_date
| table new_date PUBLISHED_DATETIME
| sort - new_date
This doesn't sound like the full story!
However, why not create your first dropdown with this query
| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"
| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y")
| dedup new_date
| fields new_date
| sort - new_date
and your second dropdown with this query
| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"
| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b")
| dedup new_date
| fields new_date
| sort - new_date
This doesn't sound like the full story!
However, why not create your first dropdown with this query
| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"
| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y")
| dedup new_date
| fields new_date
| sort - new_date
and your second dropdown with this query
| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"
| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b")
| dedup new_date
| fields new_date
| sort - new_date