Reporting

extract month from a date field

kajolsharma
Path Finder

Hi, I hav a "Planned Start date" Field through which I am trying to extract month in the format (e.g January).Can somebody suggest? Below is what i have tried 

kajolsharma_1-1630936881672.png

index="tier1" sourcetype="csv"| stats latest("Planned Start Date") AS Time| eval monthdisplay=strftime(strptime('Planned Start Date',"%m-%d-%Y"),"%B")|fields Time monthdisplay

 

 

Labels (1)
0 Karma

gcusello
Esteemed Legend

Hi @kajolsharma,

There two errors:

  • The field name to use is "Time",
  • date form is wrong.

please try something like this:

index="tier1" sourcetype="csv"
| stats latest("Planned Start Date") AS Time
| eval monthdisplay=strftime(strptime(Time,"%m/%d/%Y"),"%B")
| fields Time monthdisplay

Eventually use double quotes also in the strptime function and, possibly, avoid spaces in the field names!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...