Splunk Search

How to format output of a query

sudeep5689
Explorer

I have a query with time range earliest=-2mon@mon latest=-1mon@mon . Now can i store the result as the month name which comes between earliest and latest ? E.g., for above example its should be March

Tags (3)
0 Karma

493669
Super Champion

Try below to capital first letter of month

... | eval date_month = upper(substr(date_month,1,1)).substr(date_month,2)
0 Karma

sudeep5689
Explorer

Ok 1 more issue that o/p shows April first and then March, is there a way to show March first and then April. This o/p is coming from two queries appended together. My objective is to show a month wise comparison starting from March to April etc. and so on

0 Karma

493669
Super Champion

you may try-

|sort 0 - date_month

OR

|sort 0 - _time
0 Karma

493669
Super Champion

@sudeep5689 since date_month field is coming in your data it should have your expected month value

0 Karma

sudeep5689
Explorer

Yes thats worked but its showing the month name as march, april. Can we format it to show as April and March. Please add your solution as the answer

0 Karma

493669
Super Champion

date_month field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in date_month field.

0 Karma

sudeep5689
Explorer

Its coming fine . Just its like there are two rows coming as april and march. I want to show them like April March, first letter in caps

0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...