How to rename the _time along the x-axis of my timechart to use the month name as the column labels?

[deanamite91]

I have the following search:

index="commercial_performance" $month_token$ $Customer_token$  Cat1="Efficiency *" OR Cat1="Intervention *" OR Cat1="Entitlement *" | timechart limit=0  sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | table _time Total_*

On the x-axis I need the columns to be labeled with just the Month name rather than something like 2015-02-01T00:00.000+00:00

Can you please help?

[woodcock · Accepted solution]

I assume you meant _time, not time; if so, like this:

index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total