Splunk Search

How to format output of a query

sudeep5689
Explorer

I have a query with time range earliest=-2mon@mon latest=-1mon@mon . Now can i store the result as the month name which comes between earliest and latest ? E.g., for above example its should be March

Labels (1)
Tags (3)
0 Karma

493669
Super Champion

Try below to capital first letter of month

... | eval date_month = upper(substr(date_month,1,1)).substr(date_month,2)
0 Karma

sudeep5689
Explorer

Ok 1 more issue that o/p shows April first and then March, is there a way to show March first and then April. This o/p is coming from two queries appended together. My objective is to show a month wise comparison starting from March to April etc. and so on

0 Karma

493669
Super Champion

you may try-

|sort 0 - date_month

OR

|sort 0 - _time
0 Karma

493669
Super Champion

@sudeep5689 since date_month field is coming in your data it should have your expected month value

0 Karma

sudeep5689
Explorer

Yes thats worked but its showing the month name as march, april. Can we format it to show as April and March. Please add your solution as the answer

0 Karma

493669
Super Champion

date_month field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in date_month field.

0 Karma

sudeep5689
Explorer

Its coming fine . Just its like there are two rows coming as april and march. I want to show them like April March, first letter in caps

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!