Splunk Search

Grouping by month instead of by full date format

andrehl
Explorer

Hi guys,
Currently, my data is grouped like this:

1. Product | 2018-5-5 02:00  | 2018-5-5 02:30  | 2018-5-5 04:00  |  2018-6-5 02:00
2. asdf  | 5  | 6 |  7 | 5

I want to change my data such that it will group by month

1. Product  |  2018-5  | 2018-6
2. asdf  |  18  |  5

..
This is my code:

index=asdf
|chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name month

Helpp..

0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Hi,

You need to create a dummy field to get year and month.

| eval yearMonth=date_year."-".date_month
 |chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name yearMonth
————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi,

You need to create a dummy field to get year and month.

| eval yearMonth=date_year."-".date_month
 |chart eval(round(dc(customers_name) / 74086 * 100,2). "%") by sku_name yearMonth
————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...