Splunk Search

How to format output of a query

sudeep5689
Explorer

I have a query with time range earliest=-2mon@mon latest=-1mon@mon . Now can i store the result as the month name which comes between earliest and latest ? E.g., for above example its should be March

Tags (3)
0 Karma

493669
Super Champion

Try below to capital first letter of month

... | eval date_month = upper(substr(date_month,1,1)).substr(date_month,2)
0 Karma

sudeep5689
Explorer

Ok 1 more issue that o/p shows April first and then March, is there a way to show March first and then April. This o/p is coming from two queries appended together. My objective is to show a month wise comparison starting from March to April etc. and so on

0 Karma

493669
Super Champion

you may try-

|sort 0 - date_month

OR

|sort 0 - _time
0 Karma

493669
Super Champion

@sudeep5689 since date_month field is coming in your data it should have your expected month value

0 Karma

sudeep5689
Explorer

Yes thats worked but its showing the month name as march, april. Can we format it to show as April and March. Please add your solution as the answer

0 Karma

493669
Super Champion

date_month field should not show comma separeted values it will either show march or april but not both as comma separeted . can you share any screen shot what you are getting in date_month field.

0 Karma

sudeep5689
Explorer

Its coming fine . Just its like there are two rows coming as april and march. I want to show them like April March, first letter in caps

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...