Dashboards & Visualizations

How to show the Days in complete year?

aditsss
Motivator

I have one requirement:

I have one column in lookup as CaseCreatedDate.

It contain 175,908 data. From 2019 to 2020

Currently its showing data in this format:

2019-01-01T00:25:40.000+0000
2019-01-01T10:36:15.000+0000
2019-01-01T10:36:15.000+0000

I need to show Case_Status with it like below:

Case_CreatedDate                        Case_Status
2019-01-01T00:25:40.000+0000            Closed
2019-01-01T10:36:15.000+0000            Resolved-Fulfill
2019-01-01T10:36:15.000+0000            Resolved-Fulfill
2019-01-01T10:36:15.000+0000            Resolved-Fulfill
2019-01-01T10:36:15.000+0000            Pending-UW-Review

Is that possible to show Case_CreatedDate in years as the data is too much.

Can someone guide me on this.

Thanks in advance

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the reltime command.

| makeresults 
| eval Case_CreatedDate= "2019-01-01T00:25:40.000+0000"
| eval _time=strptime(Case_CreatedDate, "%Y-%m-%dT%H:%M:%S.%3N%Z")
| reltime 
| table Case_CreatedDate, reltime

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...