Splunk Enterprise

eval function

shreyasamin64
Explorer

need help on eval function of trimming the month 

EX : April = APR 

all months first 3 letters 

thanks 

 

Labels (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor
| makeresults 
| eval months="January February March April May June July August September October November December" 
| makemv delim=" " months
| mvexpand months
| eval short-month=upper(substr(months,1,3))
| fields - _time

Gr0und_Z3r0_0-1638346164590.png

 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor
| makeresults 
| eval months="January February March April May June July August September October November December" 
| makemv delim=" " months
| mvexpand months
| eval short-month=upper(substr(months,1,3))
| fields - _time

Gr0und_Z3r0_0-1638346164590.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval month=substr(month,1,3)
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...