Splunk Search

How to format output of a query

sudeep5689
Explorer

I have a query with time range earliest=-2mon@mon latest=-1mon@mon . Now can i store the result as the month name which comes between earliest and latest ? E.g., for above example its should be March

Labels (1)
Tags (3)
0 Karma

493669
Super Champion

Try below to capital first letter of month

... | eval date_month = upper(substr(date_month,1,1)).substr(date_month,2)
0 Karma

sudeep5689
Explorer

Ok 1 more issue that o/p shows April first and then March, is there a way to show March first and then April. This o/p is coming from two queries appended together. My objective is to show a month wise comparison starting from March to April etc. and so on

0 Karma

493669
Super Champion

you may try-

|sort 0 - date_month

OR

|sort 0 - _time
0 Karma

493669
Super Champion

@sudeep5689 since date_month field is coming in your data it should have your expected month value

0 Karma

sudeep5689
Explorer

Yes thats worked but its showing the month name as march, april. Can we format it to show as April and March. Please add your solution as the answer

0 Karma

493669
Super Champion

date_month field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in date_month field.

0 Karma

sudeep5689
Explorer

Its coming fine . Just its like there are two rows coming as april and march. I want to show them like April March, first letter in caps

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...