Splunk Search

restful call search Data format

svemurilv
Path Finder

|rest /services/authentication/users splunk_server=local |stats count by updated in this search how could we get the updated in month format like "MAY/JULY"
Am expecting data like
Month count
JULY ---2500

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

|rest /services/authentication/users splunk_server=local | eval updated=upper(strftime(strptime(substr(updated,1,10),"%Y-%m-%d"),"%B"))
|stats count by updated

View solution in original post

somesoni2
Revered Legend

Try like this

|rest /services/authentication/users splunk_server=local | eval updated=upper(strftime(strptime(substr(updated,1,10),"%Y-%m-%d"),"%B"))
|stats count by updated
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...