Splunk Search

How to rename the _time along the x-axis of my timechart to use the month name as the column labels?

deanamite91
Explorer

I have the following search:

index="commercial_performance" $month_token$ $Customer_token$  Cat1="Efficiency *" OR Cat1="Intervention *" OR Cat1="Entitlement *" | timechart limit=0  sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | table _time Total_*

On the x-axis I need the columns to be labeled with just the Month name rather than something like 2015-02-01T00:00.000+00:00

Can you please help?

1 Solution

woodcock
Esteemed Legend

I assume you meant _time, not time; if so, like this:

index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total

View solution in original post

woodcock
Esteemed Legend

I assume you meant _time, not time; if so, like this:

index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!