How do I extract a year and use as a chart?

[devfrag]

I have a csv lookup that has the date in MM/DD/YYYY format. I managed to get the data into splunk with DBConnect. Ultimately I will be creating a ITSI dashboard panel with a bar chart comparing this year to last. What is the best way to accomplish this?

Date Completed Users
1/15/2018 6113 3762
1/16/2018 2505 1714
1/13/2017 7029 4410
1/14/2017 8797 5510
1/15/2017 10165 6187
1/16/2017 11948 6569
1/17/2017 10106 5236

[nrduren1115]

You can use the strptime and strftime methods to convert them from unix timestamps back into readable dates. Using your example you could use:

| eval timestamp = strptime(Date,"%m/%d/%Y"), Year = strftime(timestamp,"%Y")

The first command takes the Date object and turns it into a 10 digit timestamp of seconds. The second command takes that time and returns the value from that timestamp you want, in this case year. The full list of time variables can be found here:

https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Commontimeformatvariables

The next step you can use to do stats grouped by Year:

| stats count, avg(Field1), max(Field2) by Year