Splunk Search

How to format _time column to display only month name

sudeep5689
Explorer

Hi i have a column _time getting displayed in the results due to timechart used in the query. Its currently getting displayed in the form of 03-2020 but i want to show it like March or Mar. Is there a way to do that?

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One of these should work. %B gives the full month name. Use %b for the abbreviated name.

... | fieldformat _time=strftime(_time, "%B")

... | eval _time = strftime(_time, "%B")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

sudeep5689
Explorer

Hi, the values looked fine in tabular view but in visualization it is causing error, Undefined NAN is coming on top of column chart

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"NAN" means "Not A Number", which is true for any month name.

It appears we have solved the specific problem, but there is a bigger problem which requires a solution. Please post a new question describing that problem.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!