Splunk Search

Total spend per field per month

Path Finder

Hi All

i am struggling with a query and appreciate some help please

i received the data on csv file - timestamp is today 

i'm interested in 3 fields Account_No , Total and Order_Date

My view looks like this:

Account_No      Total       Order_Date

123                      15.00        1/01/2023

123                      35.00        15/02/2023

123                      45.00        19/02/2023

456                      15.00         1/01/2023

456                      50.00        25/01/2023

456                     10.00        19/02/2023


I'd like a view like this

                            Account_No            Jan                Feb

Total Sum         123                          15.00            80.00

                             456                           65.00            10.00


My main issue is using the eval to change the date format that appears in the csv file from 01/01/2023 to read January 2023 or even just January will probably do for this exercise. 

I've come up with this so far

| eval Order_Date = replace(Order_Date,"01", "January") but firstly i see 06/January/2023 and not just January 

my other issue is that if any other month has 01 in it (for example 01/07/2023 it appears like this January/07/2023)

Any ideas?

Also i started looking at stats list command to group all Account_Nos together 

main search.....
| fields Order_Date Account_No Total
| stats list(Total) as Total by Account_No

i am unable to figure out how to get the subtotals for each Account_No 


Any pointers would be appreciated 


Thank you 🙂 








Labels (4)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...