Splunk Search

How to format _time column to display only month name

sudeep5689
Explorer

Hi i have a column _time getting displayed in the results due to timechart used in the query. Its currently getting displayed in the form of 03-2020 but i want to show it like March or Mar. Is there a way to do that?

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One of these should work. %B gives the full month name. Use %b for the abbreviated name.

... | fieldformat _time=strftime(_time, "%B")

... | eval _time = strftime(_time, "%B")
---
If this reply helps you, Karma would be appreciated.
0 Karma

ankitsachdeva22
New Member

Hii I've column Months getting displayed in the form of 03 but i want to show it like March or Mar. Is there way to do that....I used this result but it shows same result

 

 

 

 

 

 

0 Karma

sudeep5689
Explorer

Hi, the values looked fine in tabular view but in visualization it is causing error, Undefined NAN is coming on top of column chart

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"NAN" means "Not A Number", which is true for any month name.

It appears we have solved the specific problem, but there is a bigger problem which requires a solution. Please post a new question describing that problem.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...