Splunk Search

How to rename the _time along the x-axis of my timechart to use the month name as the column labels?

deanamite91
Explorer

I have the following search:

index="commercial_performance" $month_token$ $Customer_token$  Cat1="Efficiency *" OR Cat1="Intervention *" OR Cat1="Entitlement *" | timechart limit=0  sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | table _time Total_*

On the x-axis I need the columns to be labeled with just the Month name rather than something like 2015-02-01T00:00.000+00:00

Can you please help?

1 Solution

woodcock
Esteemed Legend

I assume you meant _time, not time; if so, like this:

index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total

View solution in original post

woodcock
Esteemed Legend

I assume you meant _time, not time; if so, like this:

index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...