Reporting

extract month from a date field

kajolsharma
Path Finder

Hi, I hav a "Planned Start date" Field through which I am trying to extract month in the format (e.g January).Can somebody suggest? Below is what i have tried 

kajolsharma_1-1630936881672.png

index="tier1" sourcetype="csv"| stats latest("Planned Start Date") AS Time| eval monthdisplay=strftime(strptime('Planned Start Date',"%m-%d-%Y"),"%B")|fields Time monthdisplay

 

 

Labels (1)
0 Karma

gcusello
Legend

Hi @kajolsharma,

There two errors:

  • The field name to use is "Time",
  • date form is wrong.

please try something like this:

index="tier1" sourcetype="csv"
| stats latest("Planned Start Date") AS Time
| eval monthdisplay=strftime(strptime(Time,"%m/%d/%Y"),"%B")
| fields Time monthdisplay

Eventually use double quotes also in the strptime function and, possibly, avoid spaces in the field names!

Ciao.

Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!