Splunk Search

How to change Date format to abbreviated month?

ajdyer2000
Path Finder

Hi was wondering if possible, how to convert a date field into an abbreviate Month (Jan , Feb, Mar, Apr)

So the 2 fields on the left are existing fields and the ones on the right would be the new ones 

Created  Closed Month_Open Month_Closed
8/27/2020 3:37 9/2/2020 12:00 Aug Sep
10/15/2020 3:31 10/21/2020 12:00 Oct Oct
11/5/2020 3:59 11/10/2020 5:17 Nov Nov
12/3/2020 3:33 4/13/2022 10:48 Dec Apr
Labels (2)
Tags (1)
0 Karma
1 Solution

ajdyer2000
Path Finder

Thank you so much Pickle Rick. That works 😊

View solution in original post

0 Karma

ajdyer2000
Path Finder

Thank you so much Pickle Rick. That works 😊

0 Karma

PickleRick
Ultra Champion

Sure. Use eval or fieldformat with strftime()

<your_search>
| eval Month_Open=stftime(Created,"%b")
| eval Month_Closed=strftime(Closed,"%b") 

You have to have your Created and Closed fields as timestamps though so if you have them as strings you'd have to strptime() them to a timestamp first. (I'm wondering if parsing out the month from the original date string and using lookup to get the month name wouldn't be more efficient but that's a completely another story).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...