restful call search Data format

[svemurilv]

|rest /services/authentication/users splunk_server=local |stats count by updated in this search how could we get the updated in month format like "MAY/JULY"
Am expecting data like
Month count
JULY ---2500

[somesoni2 · Accepted solution]

Try like this

|rest /services/authentication/users splunk_server=local | eval updated=upper(strftime(strptime(substr(updated,1,10),"%Y-%m-%d"),"%B"))
|stats count by updated