I have the following search:
index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency *" OR Cat1="Intervention *" OR Cat1="Entitlement *" | timechart limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | table _time Total_*
On the x-axis I need the columns to be labeled with just the Month name rather than something like 2015-02-01T00:00.000+00:00
Can you please help?
I assume you meant _time
, not time
; if so, like this:
index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total
I assume you meant _time
, not time
; if so, like this:
index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total